get-upheld-doc[.]pages[.]dev

Analysis as of July 24, 2026 indicates that the domain get-upheld-doc.pages.dev is associated with credential phishing activity. The site is registered through Cloudflare, Inc., and its authoritative nameservers are lynn.ns.cloudflare.com and aron.ns.cloudflare.com, confirming Cloudflare’s hosting infrastructure. DNS resolution points to IP address 172.66.46.240, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 intermediate, showing a valid TLS chain but offering no indication of legitimacy. The page title returned by the server is "Suspected phishing site | Cloudflare", and the HTTP response code is 403, indicating that the content is blocked by Cloudflare’s security mechanisms. The domain appears on one public phishing blocklist and has been actively blocked by the PhishDestroy service.

Google Safe Browsing classifies the URL as a social engineering threat, and 12 of 95 security vendors on VirusTotal have flagged the domain, reinforcing the malicious assessment. Infrastructure analysis shows the presence of HTTP/3 and HTTP Strict Transport Security (HSTS), both common on legitimate Cloudflare‑protected sites, which can be leveraged by attackers to increase trust. However, the Gridinsoft trust score is 0 out of 100, reflecting a complete lack of reputation. The domain was created on February 21, 2026, indicating a short lifespan typical of disposable phishing infrastructure. The single blocklist entry aligns with the PhishDestroy detection, suggesting coordinated reporting. The relatively low number of VirusTotal detections (12/95) does not diminish the risk, as the majority of reputable vendors have identified malicious behavior.

No additional evidence such as page content or phishing kit signatures is presently available, so the exact credential targets remain unknown.