sp11ct-lavrek-biz8-korsik-vemdor[.]pages[.]dev

The domain sp11ct-lavrek-biz8-korsik-vemdor.pages.dev is currently classified as an active phishing threat based on multiple corroborated threat intelligence sources. As of August 03, 2026, this domain is listed on two major security blocklists—PhishDestroy and OpenPhish—both of which specialize in identifying and curating phishing-related infrastructure. Additionally, technical analysis reveals that the domain is hosted through Cloudflare Pages, a platform frequently leveraged by both legitimate and malicious actors due to its ease of deployment and anonymity features. VirusTotal reports that 14 out of 91 security vendors detect this domain as malicious, indicating broad consensus among threat detection engines regarding its risk profile.

The elevated risk level is justified by the convergence of blocklist inclusion and security vendor detections, both of which are considered reliable indicators of phishing activity. There is no available information regarding the specific content, targeted brands, or exact scam type, as neither a page title nor brand targeting details are provided in the current intelligence. The infrastructure is active, and the HTTP status is presumed operational, though the exact content remains unverified.

Defenders should immediately block access to this domain within their networks, monitor for similar Cloudflare Pages deployments, and update endpoint protections to respond to the threat indicators associated with this seed. Ongoing surveillance and threat intelligence correlation are recommended, as the domain remains active and poses a continued risk to users and organizations. All evidence used in this assessment is based on current blocklist status and vendor detections, without conjecture regarding unobserved site content or brand targeting.