divace-ondeck-uphold[.]pages[.]dev

The domain divace-ondeck-uphold.pages.dev was registered through Cloudflare on February 21, 2026 and is presently listed as offline. Infrastructure analysis shows the hostname resolves to IP address 172.66.46.223, an address owned by AS13335 Cloudflare, Inc. located in the United States. The site served an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare," indicating that Cloudflare’s automated mitigation was engaged. TLS termination is provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate certificate chain despite the malicious intent.

Detected technologies include enforced HSTS, Cloudflare’s reverse‑proxy services, and HTTP/3 support, all typical of Cloudflare‑hosted content. Reputation services assign extremely low trust scores: Scamadviser 1/100, Gridinsoft 0/100, and Google Safe Browsing flags the domain for social engineering. VirusTotal reports that 13 of 93 scanning engines flagged the domain, reinforcing its malicious classification. The domain appears on a single external blocklist and has been explicitly blocked by PhishDestroy.

Nameservers stella.ns.cloudflare.com and todd.ns.cloudflare.com confirm the Cloudflare hosting configuration. While the page content has not been publicly harvested, the convergence of credential‑phishing classification, low trust scores, multiple vendor detections, and active blocklisting provides strong evidence of a phishing operation. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor related Cloudflare‑hosted subdomains for similar activity. Additional investigation of any URLs that may have been distributed before the takedown is recommended to assess potential victim exposure.