secured-upzeld-us-access-wellets[.]pages[.]dev

secured-upzeld-us-access-wellets.pages.dev is flagged by multiple security services as a credential phishing site. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to 172.66.44.93, an address belonging to AS13335 (Cloudflare, US). Cloudflare‑provided TLS is active (Google Trust Services / WE1) and the site enforces HSTS while supporting HTTP/3. Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has already taken the site offline, returning HTTP 403. The public page title returned by the server reads “Suspected phishing site | Cloudflare”.

VirusTotal scans show 15 of 93 antivirus engines flag the domain, indicating a non‑trivial detection rate. Additional telemetry includes a Gridinsoft trust score of 0 / 100 and inclusion on a single external blocklist. Nameservers are danica.ns.cloudflare.com and major.ns.cloudflare.com. Evidence confirms that the infrastructure is hosted on Cloudflare’s edge network, which complicates direct takedown but allows rapid redeployment of similar domains.

The exact phishing payload, target brand, or credential collection page has not been observed, so attribution of the lure remains unknown. Defenders should block the domain and its IP at perimeter defenses, add the associated nameservers to deny lists, and monitor for newly created subdomains under the same registrar. Continuous threat‑intel feeds should be consulted for any resurgence, and any inbound traffic logs should be inspected for attempts to reach the URL while it was active. The combination of Google Safe Browsing flag, multi‑vendor detections, and the low trust score justifies a high‑risk classification.