sp4ct-yardorin-biz8-zorex-damik[.]pages[.]dev

Analysis as of August 02, 2026 indicates that the domain sp4ct-yardorin-biz8-zorex-damik.pages.dev is actively being used in a generic phishing campaign. VirusTotal reports that 13 of 91 security vendors have flagged the domain as malicious, demonstrating a moderate level of detection across the threat‑intelligence community. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that at least one commercial sink‑hole provider has observed malicious activity originating from this host.

No public page title, brand target, or specific phishing kit information is currently available, and the underlying web content has not been disclosed in open‑source feeds. Consequently, the exact impersonated brand or credential‑harvesting technique remains unknown. The hosting environment for the domain resolves to Google Cloud’s pages.dev service, a legitimate content‑delivery platform that is frequently abused by threat actors to hide behind trusted infrastructure.

No SSL certificate anomalies have been reported, and the HTTP response code appears to be standard, suggesting the site is reachable and functional. Defenders should add the domain to internal blocklists, enforce DNS‑level filtering, and monitor outbound traffic for connections to pages.dev subdomains that match this pattern. Continuous re‑scanning with multi‑vendor engines is advised to capture any future changes in detection status, and any observed credential submissions should be routed to incident response teams for further investigation.