selion-works[.]pages[.]dev

The domain selion-works.pages.dev was a generic phishing site designed to harvest user credentials through credential phishing tactics. It did not impersonate a specific brand or deploy a known drainer kit. As of the latest verification, selion-works.pages.dev has been taken offline, though it previously posed an elevated risk to users who may have interacted with it.

Technical indicators confirm the malicious nature of selion-works.pages.dev. The domain was flagged by 15 of 95 security vendors on VirusTotal, including Criminal IP, alphaMountain.ai, and BitDefender. It appeared on 2 security blocklists, PhishDestroy and PhishingDB, and was registered through Cloudflare, Inc. on November 22, 2025. The domain resolved to the IP address 188.114.97.3, hosted by Cloudflare, Inc. (AS13335) in the US, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Suspected phishing site | Cloudflare', and the HTTP status returned a 403 error. Technologies detected included HSTS, Cloudflare, and HTTP/3, while Gridinsoft assigned it a trust score of 0/100.

Users who may have entered credentials on selion-works.pages.dev should immediately change passwords for any accounts accessed during that time, enable two-factor authentication (2FA) where available, and monitor accounts for unauthorized activity. Victims are advised to report the phishing domain to their email provider, browser vendor, or platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts. If financial or cryptocurrency accounts were involved, additional steps such as revoking token approvals or transferring funds to a new wallet may be necessary.