uphld-oi-logn[.]pages[.]dev

The domain uphld-oi-logn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as taken offline. VirusTotal records show that nine of ninety‑three security vendors flagged the domain, indicating a moderate level of detection across the scanning community. Google Safe Browsing classifies the site as a social engineering threat, and PhishDestroy has actively blocked it. The domain appears on a single security blocklist, and the Gridinsoft trust score is recorded as 0 out of 100, reinforcing the assessment of high risk.

HTTP requests to the site return a 403 status, and the page title presented by the server is "Suspected phishing site | Cloudflare," which aligns with the credential‑phishing classification supplied in the intelligence. Technical metadata reveal that the domain resolves to IP address 172.66.44.137, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The SSL certificate is issued by Google Trust Services under the WE1 designation, and the connection is protected by HSTS and HTTP/3, both typical of Cloudflare‑proxied services. Nameservers listed are ollie.ns.cloudflare.com and damiete.ns.cloudflare.com.

While the available data confirm that the infrastructure is hosted behind Cloudflare and that multiple detection engines have raised alerts, the exact phishing payload, target brand, or victim interaction flow has not been publicly disclosed. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host, and incorporate the domain and its IP address into threat intelligence feeds. Ongoing observation of Cloudflare‑associated blocklists and periodic re‑scans on VirusTotal are recommended to capture any changes in the threat posture.