sp10ct6-qurnik-biz-glarnex-fratem[.]pages[.]dev

This domain, sp10ct6-qurnik-biz-glarnex-fratem.pages.dev, is an active phishing site hosted on Cloudflare Pages infrastructure, registered on June 8, 2026. Analysis indicates elevated risk due to detection by 15 of 91 security vendors on VirusTotal and inclusion on one security blocklist, specifically PhishDestroy. The domain exhibits characteristics consistent with credential harvesting targeting cloud service users, though the exact brand impersonation remains unconfirmed as no specific brand name appears in available metadata.

Infrastructure analysis reveals the domain is served through Cloudflare's content delivery network, which is frequently leveraged by threat actors to obscure hosting origins and evade takedowns. The registration date suggests recent deployment, aligning with typical phishing campaign lifecycles. Defenders should note that while detection coverage is moderate, the domain's presence on a specialized phishing blocklist indicates targeted malicious intent.

No IP address or autonomous system details are currently available for further network-based blocking. Organizations are advised to implement immediate DNS-level blocking for this domain and monitor for related subdomains or pattern-based variations, such as sequential alphanumeric prefixes, which may emerge in subsequent campaigns. Given the domain's active status and detection history, security teams should prioritize reviewing logs for connections to this endpoint, particularly from users accessing cloud-based productivity or collaboration tools.