access-upholx-wellt-ens[.]pages[.]dev

The domain access-upholx-wellt-ens.pages.dev is a confirmed generic phishing site designed to steal user credentials through credential phishing tactics. It does not impersonate a specific brand or use a known drainer kit. As of the latest verification, the site has been taken offline, but it previously posed a high risk to visitors by harvesting login information through deceptive means.

Technical analysis shows that access-upholx-wellt-ens.pages.dev was flagged by 12 of 95 security vendors on VirusTotal, including BitDefender, CRDF, and CyRadar. Google Safe Browsing classified it under 'SOCIAL_ENGINEERING' for phishing activity. The domain was registered through Cloudflare, Inc. on November 03, 2025, and resolved to the IP address 172.66.47.110, hosted by Cloudflare in the US (AS13335). It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Suspected phishing site | Cloudflare', and the HTTP status returned was 403. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who may have interacted with access-upholx-wellt-ens.pages.dev should immediately change passwords for any accounts accessed during the exposure period, enable two-factor authentication (2FA) where available, and monitor accounts for unauthorized activity. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to assist in broader mitigation efforts. If financial or sensitive data was entered, consider contacting relevant institutions to secure accounts and prevent fraud.