nexus-internal[.]pages[.]dev

Analysis of the domain nexus-internal.pages.dev indicates active phishing infrastructure targeting corporate credentials. Registered on June 9, 2025, through Cloudflare, the domain resolves to 188.114.97.3 (AS13335, Cloudflare, Inc., US) and currently returns an HTTP 200 status with no SSL certificate. The page title 'Nexus' suggests an attempt to mimic an internal corporate portal or authentication gateway, though the exact content and targeted brand remain unconfirmed due to lack of deeper forensic analysis. Infrastructure review shows the domain is flagged by at least one security blocklist and detected by 8 of 93 security vendors in aggregated scanning results. The absence of an SSL certificate is atypical for legitimate corporate login pages and further supports the assessment of malicious intent. The domain remains active as of July 12, 2026, with no signs of takedown or mitigation. Defenders should prioritize blocking this domain at DNS and network layers, particularly in enterprise environments where 'Nexus'-themed internal portals may be expected. Monitoring for credential submissions or follow-up communications linked to this domain is recommended, as the lack of SSL may indicate an intent to harvest credentials via unencrypted channels. Further investigation into associated IP ranges and registration patterns may reveal broader campaign infrastructure.