app-nomu[.]pages[.]dev

This domain, app-nomu.pages.dev, is flagged as a cryptocurrency cashback phishing site designed to mimic legitimate shopping reward platforms. Analysis indicates the page title "Nomu | Shopping That Pays You" suggests an attempt to lure users with promises of monetary returns for purchases, a common tactic to harvest wallet credentials or deploy drainer kits. No specific drainer kit signature was identified, but the domain aligns with known phishing campaigns targeting cryptocurrency users through social engineering. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 25, 2026, and resolves to the IP address 188.114.97.3. Security vendor detections on VirusTotal report 12/95 flags, with Google Safe Browsing categorizing the domain under "SOCIAL_ENGINEERING." The domain appears on four security blocklists and employs technologies such as HSTS, Cloudflare, and HTTP/3. The SSL certificate is issued by Google Trust Services, and the domain holds a Gridinsoft trust score of 0/100, further confirming its malicious classification. The domain is currently offline, likely due to takedown actions by the hosting provider or security entities. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations and individuals are advised to block the domain and associated IP address at the network level, monitor for indicators of compromise (IoCs) such as wallet address reuse or unauthorized transactions, and educate users on recognizing social engineering tactics in cryptocurrency-related phishing schemes.