access-slush-walet[.]pages[.]dev

The domain access-slush-walet.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 response before being taken offline. TLS termination is performed by a Google Trust Services certificate (WE1), indicating that the connection was encrypted under a legitimate certificate authority. The domain resolves to Cloudflare’s authoritative nameservers amos.ns.cloudflare.com and jill.ns.cloudflare.com, and the infrastructure exhibits standard Cloudflare technologies, including HTTP/3 support and HTTP Strict Transport Security (HSTS).

Detection data shows that the domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering. Independent analysis by PhishDestroy confirmed the malicious nature, and Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme risk. VirusTotal scanned the domain with 93 scanners, of which 13 reported it as malicious, reinforcing the assessment. Current status is offline, but the short lifespan and rapid takedown suggest a targeted campaign that relied on Cloudflare’s free hosting to obscure the operator’s location.

Uncertainty remains regarding the specific credential targets, as the page title provides no brand name or victim context. Defenders should continue to monitor any residual DNS entries for re‑activation, block the IP 188.114.97.3 at network perimeter, and add the domain to internal blacklists. Organizations using Google Safe Browsing or similar URL filtering should ensure the domain is listed as a social‑engineering threat. Ongoing vigilance is advised, as the underlying Cloudflare account could be reused for future phishing deployments.