Verificação de phishing e segurança de nexonsolutions.pages.dev

PhishDestroy identifies nexonsolutions.pages.dev as a confirmed phishing domain operating under a Cloudflare Pages subdomain. The site is designed to impersonate a legitimate support portal, likely targeting users with deceptive login prompts or credential harvesting forms. Based on seed data 3f1b1c, this domain is classified under generic phishing campaigns with an active status and an under-investigation risk level. The threat actor leverages Cloudflare's infrastructure to obfuscate the true origin of the site, making it harder for traditional security tools to flag the domain proactively.

This domain resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc., which provides anonymity and rapid deployment capabilities for malicious actors. The SSL certificate is issued by Google Trust Services, further enhancing its appearance of legitimacy. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating a low initial detection rate. The domain is hosted on Cloudflare Pages, a legitimate service often abused for phishing due to its free tier and ease of setup. While the creation date is not explicitly provided, the active status and lack of detections suggest a recently deployed campaign. The absence of the domain on Google Safe Browsing (GSB) lists and other blocklists highlights the need for real-time monitoring and proactive threat intelligence sharing.

The current status of nexonsolutions.pages.dev remains active, with no immediate takedown actions observed. Security researchers and users are advised to treat this domain as hostile and avoid interaction entirely. Immediate actions include blocking the domain at the network level and updating threat intelligence feeds to include this indicator. The remaining risk is assessed as high due to the domain's low detection rate and active status. Users should remain vigilant for similar campaigns leveraging Cloudflare Pages or other legitimate hosting providers to distribute phishing content. Further investigation is required to identify the specific drainer kit or payload used by this campaign, but the lack of detections suggests a well-disguised threat.