nexus-hq-5uj[.]pages[.]dev

Analysis of nexus-hq-5uj.pages.dev indicates a recently registered Cloudflare‑proxied site that was employed for a ledger brand impersonation campaign. The domain was created on 21 February 2026 and resolves to the Cloudflare edge address 172.66.47.200, which is associated with ASN 13335 in the United States. DNS records show the authoritative nameservers elaine.ns.cloudflare.com and gerald.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. The site presented an HTTP 403 response, employed HSTS and HTTP/3, and served an SSL certificate issued by Google Trust Services under the “WE1” label, suggesting a valid TLS configuration despite malicious intent. Threat intelligence sources have classified the page title “Nexus HQ | Centro de Comando” as indicative of a command‑center façade.

The campaign targets the Ledger brand, as explicitly noted in the “Impersonates” field. PhishDestroy has already added the domain to its blocklist, and the domain appears on one additional security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious use. VirusTotal analysis shows that three of ninety‑three scanning engines flagged the domain, reinforcing the suspicion.

The current operational status is offline, indicating that the malicious content has been taken down or the hosting has been terminated. However, the underlying infrastructure—Cloudflare edge IPs and the public nameservers—remains reusable for future impersonation attempts. Defenders should continue to block the domain at perimeter defenses, monitor for re‑registration of similar subdomains, and enforce strict outbound filtering for any connections to the associated IP address. Additional scrutiny of any Ledger‑related credential submissions should be applied, and incident response teams should verify that no credential leakage occurred while the site was active.