nexuswebsite-1fy[.]pages[.]dev

Analysis indicates that the domain nexuswebsite-1fy.pages.dev was registered on 14 September 2025 via Cloudflare, Inc. The authoritative nameservers harlan.ns.cloudflare.com and olga.ns.cloudflare.com resolve the host to IP 172.66.47.119, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 identifier and enforces HTTP Strict Transport Security. Traffic is served over HTTP/3 and includes Cloudflare Browser Insights, confirming that the infrastructure is fully hosted on Cloudflare's edge network. VirusTotal scans show that two of ninety‑three security vendors have flagged the domain, and the domain is listed on at least one public blocklist, with PhishDestroy already blocking it. The page title returned by the server is “Nexus Observatories | Infrastruktura, Platforma i Przywództwo Techniczne”, but no further content analysis is available. The campaign is categorized as credential phishing and remains active as of the report date. Defenders should add the domain and its associated IP address to blocklists, monitor DNS queries for the Cloudflare nameservers, and enforce credential‑validation controls to mitigate potential credential harvesting. Additional investigation of the landing page content is recommended to determine the exact credential collection vectors.