nuego-live-apps[.]pages[.]dev

This domain, nuego-live-apps.pages.dev, is identified as a credential phishing site designed to harvest user login credentials by mimicking legitimate live application portals. Visitors are presented with fraudulent login interfaces that closely resemble authentic services, increasing the likelihood of account compromise. The site specifically targets users seeking access to cloud-based applications, exploiting trust in familiar login workflows to capture usernames, passwords, and potentially multi-factor authentication codes. No financial transaction elements or crypto wallet interactions were observed in initial analysis, distinguishing this as a pure credential theft operation rather than a crypto drainer or payment scam. Analysis indicates the domain was registered through Cloudflare, Inc. on April 03, 2026, an unusually future-dated creation that suggests either a data entry anomaly or deliberate obfuscation of actual registration timelines. The domain currently resolves to IP address 172.66.44.95 and is served with an SSL certificate issued by Google Trust Services, providing a false sense of security to visitors. VirusTotal detection metrics show 8 out of 95 security vendors flagging the domain as malicious, with specific classifications including generic phishing and brand impersonation. The domain appears on one security blocklist and is actively blocked by PhishDestroy, while Gridinsoft assigns a trust score of 0/100. Infrastructure analysis reveals the site was hosted on Cloudflare Pages, a platform frequently exploited for rapid deployment of phishing infrastructure due to its free tier and automatic SSL provisioning. Individuals who visited nuego-live-apps.pages.dev should immediately cease all interaction and assume their credentials have been compromised. If login attempts were made, users should change passwords for the affected account and any other services where identical credentials were reused. Multi-factor authentication should be enabled if not already active, using app-based or hardware tokens rather than SMS-based methods. System scans with updated security software are recommended to detect potential secondary infections. Network administrators should add the domain and associated IP 172.66.44.95 to blocklists, while monitoring for unusual authentication attempts or outbound connections to the resolved IP address. The domain's current offline status does not eliminate risk, as phishing infrastructure frequently reappears under different identifiers or IP allocations.