https://uhq.su/
104.21.87.7 · Cloudflare, Inc.
Toronto, Canada
—
403 · 16.9s
Valid· WE1, Google Trust Services, US
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
uhq.su
Vendors
28/31
Status
partial
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
technology | finance | ecommerce | other · 6/3/2026
The page presented is a Cloudflare-protected 403/Just a moment page at uhq.su, with SSL issued recently and suspected typosquint signals related to DHL. The visible HTML shows a security verification prompt typical of Cloudflare challenges, and the page includes dynamic scripts and requests to Cloudflare Turnstile endpoints, suggesting an anti-bot/captcha flow rather than a credential harvesting surface. There is no clear evidence of an impersonated brand at this time based on page content; the page title and branding do not display a known brand identity beyond the uhq.su domain, and credential collection UI is not observable in the static HTML. Given the strong anti-bot protections and lack of concrete impersonation signals, the current data does not conclusively indicate phishing against a specific brand.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 21
Hosts: 2
Domains: 2
The site currently presents a Cloudflare-based anti-bot verification page and does not show concrete impersonation of a known brand in the provided UI. However, the presence of dynamic credential collection logic within SPA scripts cannot be ruled out, and the domain has a recent SSL certificate and Cloudflare challenge components which are commonly used for both legitimate protection and phishing infrastructure. Given the combination of a nonresponsive 403 page, Cloudflare challenge activity, and the potential typosquat risk signal, monitor for any Brand impersonation signals in subsequent fetches or domain activity. The current evidence does not establish a clear phishing or credential-harvesting abuse against a specific brand.
Monitor