upholld-log-in[.]pages[.]dev

Analysis of the domain upholld-log-in.pages.dev indicates a confirmed credential phishing operation, currently offline as of July 24, 2026. The domain was registered through Cloudflare on February 21, 2026, and resolves to IP 172.66.47.22, hosted on Cloudflare's network (AS13335). Nameservers are nash.ns.cloudflare.com and kira.ns.cloudflare.com, consistent with Cloudflare's infrastructure. The SSL certificate is issued by Google Trust Services (WE1), and the site enforced HSTS and HTTP/3 protocols, typical of modern phishing kits attempting to appear legitimate. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare's automated systems flagged the content prior to takedown.

As of the report date, the domain returns an HTTP 403 status, indicating it is no longer serving active content. Detection data shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 10 of 93 vendors on VirusTotal for social engineering, aligning with the credential phishing classification. Google Safe Browsing also marks the domain for social engineering activity. No specific brand impersonation is confirmed in available data, and the exact content of the phishing page remains unanalyzed.

Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting. The use of Cloudflare Pages infrastructure is notable, as it provides free hosting and SSL, which threat actors leverage to reduce operational costs. Network defenders are advised to block the domain and IP 172.66.47.22 at perimeter controls, and monitor for related subdomains or newly registered domains under the same infrastructure. Given the domain's current offline status, further active exploitation is unlikely, but historical logs should be reviewed for connections to this domain.