sp5ct6-qarnor-biz-vroltex-slamvik[.]pages[.]dev

The domain sp5ct6-qarnor-biz-vroltex-slamvik.pages.dev was first observed on June 04, 2026. Registration metadata indicates it is hosted on Cloudflare Pages, a service frequently abused for short‑lived malicious infrastructure. The domain currently resolves to the IPv4 address 172.66.44.133. VirusTotal analysis shows that 15 of 91 scanned security vendors have flagged the domain as malicious, providing a moderate consensus of detection across independent engines.

PhishDestroy, a known anti‑phishing blocklist, has already added the domain to its deny list, and the domain appears on one additional security blocklist, confirming that at least two upstream filtering sources consider it hostile. No public information is available regarding SSL certificate details, HTTP response codes, or the page title, and no evidence from Safe Browsing, OTX, or other attribution services has been published to date. Consequently, the precise phishing payload or targeted brand remains undefined.

Defenders should immediately block any DNS resolution to 172.66.44.133 associated with this fully qualified domain name, add the domain to local and cloud‑based URL filtering policies, and monitor for any future resolution changes. Continuous re‑query of reputation services is advised, as threat actors may rotate hosting or modify the site content. Organizations using Cloudflare Pages should consider tightening outbound traffic controls for any connections to newly registered subdomains that lack a verifiable business purpose.