upheld-web-us[.]pages[.]dev

The domain upheld-web-us.pages.dev has been identified as a generic phishing site designed to impersonate Cloudflare security alerts. Analysis indicates the site was operational until recently, presenting itself as a legitimate security warning page to deceive visitors into disclosing sensitive information or executing unauthorized actions. No specific brand impersonation beyond Cloudflare’s own security page templates has been confirmed, but the site’s structure and content align with credential harvesting tactics commonly used in phishing campaigns. Infrastructure analysis reveals the domain was registered on November 01, 2025, through Cloudflare, Inc., and resolved to the IP address 172.66.47.91, hosted on autonomous system AS13335. The domain appears on one security blocklist and is flagged by 15 of 95 security vendors on VirusTotal as malicious. Google Safe Browsing has also classified the domain as phishing, and the SSL certificate is issued by Google Trust Services under the WE1 intermediate. The page title, 'Suspected phishing site | Cloudflare,' was likely an attempt to mimic Cloudflare’s own interstitial warnings, further indicating an intent to deceive users into bypassing security measures. The domain is currently offline, but historical activity and infrastructure details suggest it was part of a broader phishing operation. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should review logs for connections to 172.66.47.91 or the domain name to identify potential compromise. Users who interacted with the site should reset credentials and monitor accounts for unauthorized activity. Given the domain’s recent creation and rapid takedown, vigilance for similar domains registered through the same infrastructure is recommended.