sp10ct-galek-biz8-lurep-domin[.]pages[.]dev

Analysis of sp10ct-galek-biz8-lurep-domin.pages.dev shows that the domain is provisioned through Cloudflare Pages, indicating a serverless hosting architecture backed by Cloudflare's edge network. HTTPS is enforced by default on Cloudflare Pages, so the site presents a valid TLS certificate issued to the hosting provider rather than the domain owner. The domain has been observed on two independent security blocklists and is actively listed by PhishDestroy and OpenPhish, both of which classify it as a generic phishing site.

VirusTotal scans reveal that 15 out of 91 security vendors have flagged the domain as malicious, reinforcing the blocklist findings. No additional metadata such as page title, brand targeting, or specific scam kit details are presently available, and the content of the site has not been publicly analyzed. The available evidence is limited to registry information, blocklist inclusion, and vendor detections, confirming a consistent threat posture across multiple sources.

Defenders should enforce network‑level denial for the domain, update URL filtering policies to include it, and monitor for any future resolution changes that could indicate a shift in hosting infrastructure. Continued vigilance is advised, as the underlying Cloudflare edge can dynamically allocate IP addresses, potentially affecting downstream detection mechanisms.