sp11ct-korsel-biz8-zemvik-farnor[.]pages[.]dev

Analysis of sp11ct-korsel-biz8-zemvik-farnor.pages.dev shows that the domain is actively used for phishing, as indicated by multiple independent threat‑intelligence sources. VirusTotal reports that 14 of 91 scanned security vendors flag the domain, demonstrating a consensus among reputable scanners that the site hosts malicious content. The domain is listed on two public blocklists and has been explicitly blocked by PhishDestroy and OpenPhish, both of which specialize in curating phishing infrastructure.

Registration information reveals that the site is hosted on Cloudflare Pages, a serverless platform that fronts content behind Cloudflare’s global edge network. This hosting choice obscures the underlying origin server and can complicate attribution, but it also confirms that the domain benefits from Cloudflare’s SSL termination and CDN services, which are commonly abused to lend legitimacy to fraudulent sites. No additional metadata such as IP address, ASN, or HTTP response details are presently available, and the page title or any brand targeting information has not been disclosed in the current intelligence set.

The absence of these details limits a deeper infrastructure fingerprint, but the existing evidence is sufficient to categorize the domain as a confirmed phishing threat. Defenders should immediately add the domain to network and endpoint blocklists, enforce DNS‑level filtering, and monitor for any related activity originating from Cloudflare‑hosted resources. Continuous re‑scanning with VirusTotal and periodic checks against the referenced blocklists are recommended to capture any evolution in the site’s behavior or additional detection signatures.