connect-upheld-access[.]pages[.]dev

The domain connect-upheld-access.pages.dev is presently offline and has been identified as a credential phishing site. It was registered on February 21 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.110, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and returned HTTP status code 403 at the time of capture. TLS termination is provided by a Google Trust Services / WE1 certificate, and the server advertises HSTS, Cloudflare edge services, and HTTP/3 support. Security vetting shows that 12 of 95 VirusTotal scanners flagged the domain, and Google Safe Browsing classifies it as a social engineering threat.

The Gridinsoft trust score is 0 out of 100. The domain is listed on one external blocklist and has been manually blocked by PhishDestroy. Nameservers are dimitris.ns.cloudflare.com and isabel.ns.cloudflare.com. Uncertainty remains regarding the exact credential target and the content of any phishing pages because the site is offline, limiting dynamic analysis.

The limited blocklist presence suggests a relatively low distribution footprint, yet detection by multiple vendors indicates active malicious use. Defenders should add the domain and its associated IP address to network deny lists, monitor DNS queries for the two Cloudflare nameservers, and enforce web proxy filtering for any URL containing "connect-upheld-access.pages.dev". Because the TLS certificate is issued by Google Trust Services, organizations may need to enable TLS inspection to view underlying traffic if the site reactivates. Continuous re‑scanning on VirusTotal and inclusion in threat intelligence feeds is recommended, and any compromised credentials discovered should be rotated promptly.