sp11ct-keltra-biz8-vormex-drasil[.]pages[.]dev

On August 03, 2026, analysis of the domain sp11ct-keltra-biz8-vormex-drasil.pages.dev identified it as an active generic phishing infrastructure. The domain is listed on two reputable blocklists, specifically PhishDestroy and OpenPhish, indicating that multiple threat‑intelligence providers have confirmed its malicious intent. VirusTotal reports that 14 of 91 scanned security vendors have flagged the domain, providing independent corroboration of its risk profile.

No additional metadata such as registrar, IP address, or hosting ASN is available in the current intelligence set, limiting deeper infrastructure attribution at this time. The observed detection count, combined with the presence on established phishing blocklists, elevates the domain to an elevated risk level as defined by the reporting taxonomy.

Defenders are advised to incorporate the domain into URL filtering policies, enforce block‑list updates, and monitor for any related DNS or HTTP traffic in their environments. Continuous re‑evaluation is recommended, as further technical artifacts (e.g., SSL certificate details, HTTP response codes, or page content) may emerge that could refine attribution or impact mitigation strategies.