sp3ct-warnex-biz8-lovqen-kirad[.]pages[.]dev

Analysis of the domain sp3ct-warnex-biz8-lovqen-kirad.pages.dev shows that it is currently active and has been classified with an elevated risk rating. The site is hosted on Cloudflare Pages, as indicated by the registration information, and resolves to the IP address 172.66.46.250, which is part of Cloudflare’s global edge network. VirusTotal has recorded 18 detections out of 91 scanned security engines, confirming that multiple vendors have identified malicious behavior associated with the domain. The domain also appears on a single public phishing blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the notion of abusive use.

No public page title, SSL certificate details, or brand‑specific spoofing information have been disclosed, so the exact visual or credential‑harvesting tactics remain unknown. The lack of content analysis means that defenders cannot yet ascertain the specific lure or credential collection method employed, but the consensus among scanning engines and blocklist operators is sufficient to label the site as a generic phishing platform. Defenders should immediately add the domain to URL filtering rules, block the associated IP address, and monitor for any related sub‑domains that may be provisioned on the same Cloudflare account.

Network sensors should be configured to flag outbound connections to 172.66.46.250, and endpoint protection solutions should enforce the blocklist entry reported by PhishDestroy. Continuous re‑scanning of the domain is advised, as phishing sites often evolve rapidly and may introduce new payloads or targeting vectors. Until further forensic evidence is obtained, the precautionary stance of full denial is the recommended mitigation.