sp11ct-ralvek-biz8-kormel-dasvik[.]pages[.]dev

This domain, sp11ct-ralvek-biz8-kormel-dasvik.pages.dev, is currently flagged as a generic phishing threat as of August 03, 2026. It is active and carries an elevated risk level. Analysis indicates that the domain appears on two independent security blocklists, specifically PhishDestroy and OpenPhish, which are reputable sources for identifying malicious web infrastructure. A VirusTotal scan of the domain shows that 12 out of 91 security vendors flag it as malicious, indicating a notable but not unanimous consensus among detection engines.

The domain is hosted on the pages.dev subdomain, which is a free web hosting service provided by Cloudflare. This hosting choice is commonly abused by threat actors due to its low cost and ease of deployment, though no specific ASN or country information is available in the current intelligence. The exact content of the page has not yet been analyzed, so no specific brand, login form, or scam category can be confirmed. The domain's structure, with random alphanumeric segments, is consistent with automated generation for phishing campaigns.

Defenders should treat this domain as a potential threat, block access at the network or DNS level, and monitor for related subdomains on pages.dev that may share similar naming patterns. Users who have interacted with this domain should be cautious about any credentials or personal information they may have submitted, as it could be compromised. Further investigation is recommended to determine the specific phishing lure and to collect indicators of compromise for broader threat hunting. The elevated risk level and active status warrant immediate attention from security operations teams.