sp11ct-lomvek-biz8-tresan-farnix[.]pages[.]dev

This domain, sp11ct-lomvek-biz8-tresan-farnix.pages.dev, was observed on 2026-08-03 as an active generic phishing infrastructure. VirusTotal analysis shows that 14 of 91 scanned security vendors have flagged the host, indicating a moderate level of consensus among scanners. The domain is hosted on Cloudflare Pages, a service that provides automatic TLS termination and edge caching, which can obscure the true origin of the payload. Independent phishing intelligence feeds have added the host to their blocklists; both PhishDestroy and OpenPhish list it as malicious, and it appears on two additional security blocklists.

The registrar information confirms Cloudflare Pages as the registration point, which means the domain benefits from Cloudflare’s rapid provisioning and privacy‑friendly registration policies, complicating takedown efforts. No explicit IP address, ASN, or geographic data is supplied in the current intelligence set, so the underlying hosting location remains indeterminate. The lack of publicly available page‑title or brand targeting details limits attribution of the lure used in the campaign. Defenders should prioritize immediate blocking of the domain at network perimeter and DNS filtering layers, and they should incorporate the domain hash into endpoint detection signatures.

Continuous monitoring of Cloudflare Pages subdomains for similar naming patterns is advised, as attackers frequently recycle the platform for short‑lived phishing sites. Incident response teams should also verify whether any credential‑theft attempts have been logged against corporate accounts, and, if so, enforce credential resets and review authentication logs for abuse. The elevated risk rating reflects the combination of vendor detections, blocklist presence, and the use of a reputable hosting provider that can facilitate rapid deployment. Until further forensic artifacts become available, the domain should be treated as hostile and excluded from trusted web traffic.