sp10ct6-tranik-biz-fraltem-qurnex[.]pages[.]dev

This domain, sp10ct6-tranik-biz-fraltem-qurnex.pages.dev, was registered on June 8, 2026 via the Cloudflare Pages service. The authoritative DNS resolves to the IP address 188.114.96.3, an address commonly associated with Cloudflare’s edge network. VirusTotal has recorded 12 detections out of 91 scanned security vendors, indicating that a subset of anti‑malware engines have identified malicious characteristics. The domain is presently listed on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation platform, reinforcing the perception of hostile intent.

The threat classification supplied is generic phishing, and the risk level is elevated, with the campaign status marked as active as of the report date, July 29, 2026. Evidence from the available intelligence confirms the presence of typical phishing infrastructure: the use of a Cloudflare‑hosted pages.dev subdomain, rapid creation date, and early inclusion on blocklists. No additional data such as SSL certificate details, HTTP response codes, page title, or brand targeting have been published, leaving the exact content of the site unknown. Consequently, defenders cannot rely on content‑specific signatures and must focus on network‑level indicators.

Recommended mitigation steps include adding the IP address 188.114.96.3 to deny lists, enforcing DNS filtering for the full domain name, and ensuring that security solutions ingest the VirusTotal detection count and the PhishDestroy block status. Continuous monitoring of outbound connections to the Cloudflare edge network for anomalous patterns is advised, as is periodic re‑query of reputation services to capture any new detections. Organizations should also consider educating users about unsolicited communications that may reference this domain, given its classification as a generic phishing vector.