wel-ledzer-learn[.]pages[.]dev

Analysis of wel-ledzer-learn.pages.dev shows that the domain is actively being used for credential harvesting, a generic phishing technique. The domain resolves to the IP address 172.66.44.153 and is hosted behind Cloudflare’s infrastructure, as indicated by the registrar record and the authoritative nameservers keaton.ns.cloudflare.com and paloma.ns.cloudflare.com. Cloudflare registration does not provide any direct indication of malicious intent, but the use of a reputable CDN is a common tactic to obscure the true origin of phishing traffic.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that threat intelligence feeds have identified it as malicious. VirusTotal has processed the domain with scans from 91 antivirus and URL‑reputation vendors; none of the vendors reported a detection, but the absence of a detection does not constitute a safety guarantee and should be treated as a neutral data point. No public Safe Browsing, OTX, SSL certificate details, HTTP response codes, or trust‑score metrics are presently available for this host, leaving gaps in the observable surface.

Defenders should therefore treat the domain as hostile: block DNS resolution and HTTP(S) traffic to 172.66.44.153, add the domain to internal blocklists, and monitor for any attempted credential submissions targeting this host. Continuous re‑evaluation is advised, as additional intelligence—such as page content analysis, SSL fingerprinting, or emerging vendor detections—may surface and refine the risk posture.