upholdd-web-us[.]pages[.]dev

Analysis indicates that the domain upholdd-web-us.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to the IP address 172.66.47.24, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 trust chain, confirming that the site used a valid SSL certificate from a reputable authority. An HTTP request returned a 403 status code and the page title returned by the server is “Suspected phishing site | Cloudflare”, which is a generic warning page served by Cloudflare when a site is flagged for malicious activity. Infrastructure analysis reveals that the site employed HSTS, HTTP/3, and Cloudflare’s edge network, indicating that the attacker leveraged Cloudflare’s CDN services for hosting and possibly for evading IP‑based takedowns. Reputation services show a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust.

The domain appears on one known security blocklist and has been explicitly blocked by PhishDestroy, a phishing mitigation service. VirusTotal scanned the domain and 5 out of 93 security vendors reported it as malicious, providing additional independent confirmation of malicious intent. The nameservers listed are laila.ns.cloudflare.com and norman.ns.cloudflare.com, both standard Cloudflare name servers. The available evidence points to a credential‑phishing campaign, as indicated by the recorded scam type “Credential Phishing”. The page title and blocklist entries suggest that the site was hosting a phishing landing page before being taken offline.

Because the site is currently offline, further content analysis is not possible, and the exact payload, targeted brand, or compromised credentials remain unknown. Defenders should immediately add upholdd‑web‑us.pages.dev to DNS‑based deny lists and block outbound connections to 172.66.47.24.