nexus-the-council[.]pages[.]dev

Analysis of nexus-the-council.pages.dev shows a domain created on 21 February 2026 and registered through Cloudflare, Inc. The site was served without an SSL certificate and resolved to IP address 172.66.46.249, which is owned by AS13335 Cloudflare, Inc. located in the United States. The page title returned by the server was "Suspected phishing site | Cloudflare," indicating that the host platform had already flagged the content as malicious. VirusTotal recorded detections from four of ninety‑three security vendors, confirming that some scanning engines consider the domain malicious.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Current monitoring shows the site is offline, suggesting the malicious content has been taken down or the hosting provider has removed service. Evidence gaps remain: no TLS certificate means encrypted traffic cannot be inspected, the exact phishing payload or targeted brand has not been disclosed, and no safe‑browsing or OTX entries were provided.

Defenders should add 172.66.46.249 to network‑level deny lists, enforce DNS filtering for nexus-the-council.pages.dev, and monitor Cloudflare‑hosted IP ranges for similar rapid‑deployment domains. Continuous re‑scanning of the domain through multi‑vendor services is advised to capture any future re‑hosting attempts, and security teams should verify that endpoint protection solutions are updated with the four vendor detections reported by VirusTotal.