wellet-us-en-access-upholld[.]pages[.]dev

Analysis of wellet-us-en-access-upholld.pages.dev confirms it as a credential phishing domain, now offline but previously active under Cloudflare infrastructure. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to IP 172.66.47.112 (AS13335, Cloudflare, Inc., US). Nameservers danica.ns.cloudflare.com and major.ns.cloudflare.com further tie it to Cloudflare’s network. At the time of assessment, the domain returned an HTTP 403 status, with Cloudflare’s interstitial page titled 'Suspected phishing site,' indicating automated detection of malicious activity.

Google Safe Browsing classified the site as engaging in social engineering, while Gridinsoft assigned a trust score of 0/100. The domain appears on at least one security blocklist (PhishDestroy) and was flagged by 11 of 93 security vendors in VirusTotal scans, though the exact nature of the credential harvesting—whether targeting financial services, email providers, or other platforms—remains unconfirmed due to the lack of page content analysis. The SSL certificate, issued by Google Trust Services (WE1), does not provide additional forensic value beyond standard Cloudflare provisioning. Infrastructure analysis reveals the use of HTTP/3 and HSTS, common for modern phishing sites leveraging Cloudflare’s performance and obfuscation features.

The domain’s abrupt takedown suggests intervention by Cloudflare or external security teams, but residual risk persists for users who may have interacted with the site prior to its removal. Defenders should treat this domain as a confirmed phishing asset, block it at DNS and proxy levels, and monitor for related subdomains or IP reuse under Cloudflare’s AS13335. No evidence links this domain to a specific brand or phishing kit, limiting attribution beyond the credential phishing classification.