sp11ct-polnix-biz8-zarsel-havrek[.]pages[.]dev

This domain is hosted on Cloudflare Pages, as indicated by the registrar information. The infrastructure is therefore served from Cloudflare's edge network, which can obscure the originating IP address and complicate attribution. The domain appears on two public security blocklists and is actively blocked by PhishDestroy and OpenPhish, confirming that multiple threat‑intelligence feeds have identified it as malicious.

VirusTotal analysis shows that 14 of 91 scanned security vendors have flagged the domain, reinforcing the suspicion of malicious activity. The threat type is classified as generic phishing and the risk level is elevated; the campaign remains active as of the report date, August 03 2026. No additional metadata such as SSL certificate details, HTTP response codes, or page title have been disclosed, so the exact content served by the site cannot be confirmed at this time.

Defenders should prioritize blocking any network traffic to sp11ct-polnix-biz8-zarsel-havrek.pages.dev at the DNS or proxy level, incorporate the domain into existing URL filtering rules, and monitor for any outbound connections that may be routed through Cloudflare's edge. Because the underlying IP addresses are likely shared among many legitimate Cloudflare customers, reliance on IP‑based blocking alone may generate false positives; therefore, domain‑level controls are recommended. Continuous monitoring of the two blocklists that currently list the domain, as well as periodic re‑scans on VirusTotal, will help maintain situational awareness as the campaign evolves.