xdu-web-welet-us-en[.]pages[.]dev

The domain xdu-web-welet-us-en.pages.dev is a generic phishing site designed to steal user credentials through credential phishing tactics. It does not impersonate a specific brand or use a known drainer kit. As of the latest verification, xdu-web-welet-us-en.pages.dev has been taken offline, but it previously posed an elevated risk to users who may have interacted with it.

Technical indicators confirm the malicious nature of xdu-web-welet-us-en.pages.dev. The domain was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and Phishing Database, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through Cloudflare, Inc. on March 04, 2026, it resolved to the IP address 172.66.46.243, hosted by Cloudflare (AS13335) in the US. The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. The domain used nameservers etta.ns.cloudflare.com and uriah.ns.cloudflare.com and returned an HTTP 403 status when accessed. Gridinsoft assigned it a trust score of 0/100.

Users who may have entered credentials on xdu-web-welet-us-en.pages.dev should immediately change passwords for any accounts accessed from the site and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspected fraud to financial institutions or relevant service providers. To report the domain, submit it to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities for further investigation.