welcome-web3-bfnaelmomeimhlpmgjnjophhpkkoljpa[.]pages[.]dev

The domain welcome-web3-bfnaelmomeimhlpmgjnjophhpkkoljpa.pages.dev is currently classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain is hosted on Cloudflare Pages, a serverless web‑hosting service that provides automatic TLS termination and a shared IP pool. The domain appears on two public security blocklists and is listed by PhishDestroy and OpenPhish as a confirmed phishing source.

Google Safe Browsing also flags the URL for social engineering, indicating that the site is recognized as a vector for credential‑stealing or fraudulent credential collection. VirusTotal reports that 18 of 91 scanned security vendors have identified malicious behavior, reinforcing the suspicion of phishing activity. The exact page content, HTTP response codes, and SSL certificate details have not been publicly disclosed, so the full technical footprint remains partially unknown.

No evidence of additional infrastructure such as command‑and‑control servers, file‑hosting services, or compromised hosts is presently available. Defenders should immediately add the domain to URL filtering and DNS‑based blocklists, monitor for any outbound connections to the Cloudflare edge network that originate from internal hosts, and enforce multi‑factor authentication to mitigate credential compromise. Continuous re‑evaluation is advised as further intelligence may emerge from additional scans or threat‑intel feeds.