nibirufi-5mq[.]pages[.]dev

This domain, nibirufi-5mq.pages.dev, is actively engaged in credential theft operations targeting users of cloud-based platforms. Analysis indicates the site mimics legitimate authentication portals, likely using cloned login interfaces to harvest usernames, passwords, and session tokens. The domain employs social engineering tactics, such as urgent account verification requests or fake security alerts, to trick victims into submitting sensitive credentials. Given the infrastructure and targeting patterns, this campaign appears to focus on users of enterprise cloud services, potentially leading to unauthorized access to corporate or personal data stores. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on May 25, 2026, a platform often abused for its free hosting and SSL capabilities. As of the latest scan, the domain is flagged by 1 out of 95 security vendors on VirusTotal, indicating low initial detection but growing awareness. It appears on two independent security blocklists, including feeds specializing in phishing and fraud prevention. The domain remains active, suggesting the campaign is ongoing and may escalate in sophistication or volume. Users who have visited nibirufi-5mq.pages.dev or entered credentials on the site should immediately revoke any active sessions associated with the affected account. Rotate passwords for all accounts where the same credentials may have been reused, prioritizing email, financial, and cloud service platforms. Enable multi-factor authentication (MFA) where available, using app-based or hardware tokens rather than SMS-based methods. Monitor account activity for unauthorized access or transactions, and report any suspicious behavior to the relevant service provider. If corporate credentials were exposed, notify internal security teams to assess potential lateral movement or data exfiltration risks.