sp11ct-ravnor-biz8-kelsik-domvek[.]pages[.]dev

Analysis as of August 03, 2026 indicates that the domain sp11ct-ravnor-biz8-kelsik-domvek.pages.dev is actively used for generic phishing. The domain is hosted on Cloudflare Pages, a serverless platform that provides CDN and DNS services. VirusTotal reports that 13 of 91 scanned security vendors have flagged the domain as malicious, demonstrating a moderate consensus among detection engines.

Independent phishing feed aggregators PhishDestroy and OpenPhish have both listed the domain, and it appears on two additional security blocklists, confirming its presence in known malicious URL repositories. The domain’s registration through Cloudflare obscures direct WHOIS details, limiting attribution of the registrant. No further public metadata such as SSL certificate details, HTTP response codes, or page titles have been disclosed, leaving the exact content and lure mechanisms unverified.

The elevated risk rating reflects the combination of vendor detections and blocklist presence. Defenders should block network connections to the domain at perimeter firewalls and DNS resolvers, update endpoint security signatures to include the observed indicators, and monitor for any attempted credential submissions that reference the domain. Continuous re‑evaluation is recommended as additional analysis, such as content retrieval or sandbox execution, may reveal further tactics, techniques, and procedures.