nexusbridger1[.]pages[.]dev

PhishDestroy identifies nexusbridger1.pages.dev as an active crypto-wallet phishing domain engineered to harvest private keys and seed phrases. The site mimics legitimate cryptocurrency services, tricking users into entering credentials or connecting Web3 wallets. Security telemetry confirms it is already blocked by MetaMask and ScamSniffer, and it appears on three independent blocklists, indicating widespread abuse. The domain resolves to 172.66.47.164 via Cloudflare’s proxy network and holds a Google Trust Services SSL certificate, giving it an air of legitimacy while concealing its malicious origin. This domain was flagged by 8 of 95 VirusTotal security vendors and has been formally categorized as an active phishing threat. Registrant details remain obscured behind Cloudflare, Inc., preventing attribution. It leverages the *.pages.dev namespace powered by Cloudflare Pages to host rapidly changing content, evading static takedown measures. The elevated risk stems from its dual-purpose infrastructure: it serves as both a credential-grabbing portal and a malware distribution node for clipboard hijackers that swap wallet addresses during transactions. Users who visited nexusbridger1.pages.dev should immediately revoke any wallet connections via their wallet’s connection manager and inspect transaction histories for unauthorized transfers. Generate a fresh set of seed phrases for wallets that may have been exposed and move remaining assets to a newly created, hardware-isolated wallet. If the device used to access the site was shared or unpatched, perform a full antivirus scan to detect any resident keyloggers or clipboard manipulators that could still be active.