nexus-ui-service[.]pages[.]dev

Analysis of nexus-ui-service.pages.dev indicates it is a credential‑phishing domain that has been taken offline. The domain was registered on February 21, 2026 via Cloudflare, Inc., and resolves to the Cloudflare edge address 162.159.140.86, which is associated with AS13335 in the United States. DNS resolution uses the Cloudflare nameservers carla.ns.cloudflare.com and clint.ns.cloudflare.com, and the service presents a valid SSL certificate issued by Google Trust Services under the WE1 designation, with HSTS and HTTP/3 enabled. An HTTP request returns a 403 status code, suggesting the site is currently inaccessible.

The page title returned from the host is "Procore App," matching the declared scam type of credential phishing. Reputation data shows a Gridinsoft trust score of 0 / 100 and that the domain appears on one security blocklist. VirusTotal reports a single detection out of 93 scanned vendors, and the domain is listed as blocked by the PhishDestroy feed. The limited detection count indicates that at least one security vendor has flagged the site, but the low overall detection suggests the domain may have been short‑lived or not widely distributed before takedown.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same sub‑domain pattern under pages.dev, and add the IP address 162.159.140.86 to any outbound allow/deny lists pending further investigation, keeping in mind that the address is shared across many Cloudflare customers. Because the site is offline, active exploitation cannot be confirmed, but the presence of a credential‑phishing label, low trust score, and a vendor detection warrants maintaining the block and updating threat‑intel feeds. Continuous monitoring of Cloudflare‑hosted pages.dev subdomains for similar page titles or SSL certificates is recommended to catch future iterations.