uphol-d-logn-eng[.]pages[.]dev

This domain is flagged as an elevated-risk credential harvesting phishing site targeting user authentication credentials. Analysis indicates the infrastructure was specifically designed to mimic legitimate login portals, a common tactic in credential theft campaigns. The domain exhibits multiple high-confidence indicators of malicious activity, warranting immediate caution from users and security teams. Infrastructure analysis reveals the following technical indicators: the domain is registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused in phishing operations. The domain was created on November 04, 2025, suggesting recent deployment for malicious purposes. It appears on one security blocklist and is detected by 10 out of 95 security vendors on VirusTotal, with the page title explicitly stating 'Suspected phishing site | Cloudflare.' The domain is currently offline but was previously blocked by security systems. Mitigation steps for this specific threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Security teams should conduct retrospective analysis of network logs for connections to 188.114.96.3 or the domain name, particularly from systems that handle authentication credentials. Users who may have interacted with the site should be instructed to reset passwords through official channels and enable multi-factor authentication where available. Organizations should monitor for follow-up phishing attempts using similar domain naming patterns (e.g., 'logn-eng' variations) and implement DMARC/DKIM/SPF policies to prevent domain spoofing. Given the Cloudflare hosting, security teams should also review Cloudflare-specific phishing detection capabilities and consider implementing additional scrutiny for pages.dev subdomains.