uphould-log[.]pages[.]dev

Analysis of the domain uphould-log.pages.dev indicates it was a credential phishing site operational under Cloudflare hosting. The domain, registered on February 21, 2026, resolved to IP 172.66.44.96 (AS13335, Cloudflare, Inc., US) and used nameservers elmo.ns.cloudflare.com and tina.ns.cloudflare.com. As of July 25, 2026, the domain is offline, returning an HTTP 403 status with a page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated detection systems flagged it prior to takedown. Infrastructure analysis reveals the domain was served via Cloudflare's edge network, utilizing HSTS and HTTP/3 protocols. The SSL certificate was issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted sites.

Detection data from July 2026 shows the domain was flagged by 10 of 93 security vendors on VirusTotal, though the specific detection rules or payloads are not publicly disclosed. It appeared on a single security blocklist, and Google Safe Browsing classified it as social engineering content. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The scam type is explicitly identified as credential phishing, though the exact brand or service targeted remains unconfirmed due to the lack of detailed page content analysis.

No evidence links the domain to a specific phishing kit or campaign. Defenders should treat any prior connections to this domain as high-risk, particularly if credentials or session tokens were transmitted. Network-level blocks at 172.66.44.96 and monitoring for related subdomains under *.pages.dev are recommended. The domain's current offline status does not preclude future reactivation; continuous monitoring of associated infrastructure (Cloudflare nameservers, AS13335) is advised.