sp11ct-corzen-biz8-vemral-koltra[.]pages[.]dev

Analysis of sp11ct-corzen-biz8-vemral-koltra.pages.dev indicates active generic phishing infrastructure as of the report date, August 03, 2026. VirusTotal scans show that 13 of 91 security vendors have flagged the domain, providing an early indication of malicious intent. The domain is listed on two external blocklists, specifically PhishDestroy and OpenPhish, confirming that reputable anti‑phishing feeds consider it a threat.

Registration details reveal that the domain is provisioned through Cloudflare Pages, a serverless hosting service that abstracts the underlying web server and often hides the origin IP address, making attribution and takedown more challenging. No additional public metadata such as IP address, SSL certificate details, or HTTP response codes are currently available, leaving the broader hosting footprint uncertain. Defenders should prioritize immediate containment by adding the domain to DNS‑level blocklists and web‑proxy filtering rules, ensuring that any outbound or inbound traffic to the host is denied.

Continuous monitoring of outbound DNS queries for this FQDN is advised, as well as periodic re‑scanning on VirusTotal and other sandbox environments to capture any evolution in payload or hosting changes. Given its presence on multiple phishing feeds and the modest vendor detection count, the risk posture remains elevated, and organizations handling credential‑sensitive workflows should treat any interaction with this domain as malicious until proven otherwise.