begin-app-sso-iphold[.]pages[.]dev

begin-app-sso-iphold.pages.dev was observed hosting a page titled “Suspected phishing site | Cloudflare”. The site was provisioned on 21 February 2026 and is served via Cloudflare’s network (nameservers grace.ns.cloudflare.com and javon.ns.cloudflare.com). HTTP responses return 403 and the connection enforces HSTS and HTTP/3, indicating a modern TLS configuration. The presented TLS certificate is issued by Google Trust Services under the “WE1” label.

Network resolution points to IP 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. Malware and URL analysis on VirusTotal recorded nine positive detections out of ninety‑five scanning engines, and Google Safe Browsing classifies the URL as a social‑engineering threat. Independent blocklists, including PhishDestroy, have listed the domain, and Gridinsoft assigned a trust score of zero out of one hundred. The domain currently reports an offline status and appears on a single security blocklist.

The available evidence consistently points to a credential‑phishing campaign, though the specific target brand or credential type has not been disclosed in the collected data. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP range, and consider adding the domain to internal allow‑list exclusions for false‑positive mitigation if necessary. Ongoing observation is recommended to detect any re‑activation or related infrastructure that may reuse the same Cloudflare‑hosted sub‑domain pattern.