wel-legor-start[.]pages[.]dev

wel-legor-start.pages.dev has been flagged as a phishing site under active investigation for hosting a fake login portal. The threat type is generic phishing, with a current risk level marked as 'under_investigation' but confirmed malicious. Analysis shows this domain resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. Despite zero detections on VirusTotal (3/95), the domain’s purpose aligns with credential harvesting, posing a high risk to unsuspecting users. PhishDestroy identifies this domain as a deceptive login portal designed to trick users into submitting sensitive credentials. Technical indicators include registration through Cloudflare, Inc., a trusted but often abused hosting provider, and an SSL certificate issued by Google Trust Services, which lends false legitimacy. The domain resolves to IP 188.114.97.3, a Cloudflare IP, and remains undetected by VirusTotal’s 95 engines as of the latest scan. While creation dates and blocklist status are not explicitly confirmed, the lack of detections suggests it may be a recently deployed or obfuscated threat. The absence of detections does not equate to safety, particularly given the domain’s clear phishing intent. Users should immediately avoid interacting with wel-legor-start.pages.dev, as it is likely part of a broader credential-harvesting campaign. If credentials were entered, users must change passwords immediately and enable multi-factor authentication on all linked accounts. Organizations should consider blocking this IP (188.114.97.3) and domain at the network level. Always verify URLs through official channels and report suspicious domains to security teams or phishing reporting platforms. Cloudflare’s hosting does not guarantee safety, as threat actors frequently exploit legitimate services to evade detection.