sp11ct-polrek-biz8-farnix-lomvek[.]pages[.]dev

Analysis of sp11ct-polrek-biz8-farnix-lomvek.pages.dev indicates an elevated‑risk generic phishing infrastructure that remains active as of the report date, August 03, 2026. The domain is hosted on Cloudflare Pages, a serverless platform that frequently provides a shared IP space and TLS termination. No unique IP address is disclosed, but the Cloudflare association suggests the site benefits from the provider’s built‑in DDoS mitigation and global CDN. The domain appears on two external blocklists and has been actively blocked by the PhishDestroy and OpenPhish feeds, confirming that at least two reputable anti‑phishing aggregators have identified malicious content tied to this host.

VirusTotal scans show that 13 of 91 security vendors have flagged the domain, providing independent confirmation of abnormal behavior. The detection count, while not universal, is sufficient to warrant caution, especially when combined with the blocklist presence. The evidence does not reveal the exact landing page or the credential‑harvesting technique, leaving the precise phishing vector uncertain. Defenders should treat any outbound request to this domain as malicious, enforce URL filtering, and consider adding the host to internal deny lists.

Continuous monitoring of Cloudflare‑hosted subdomains is advised, as the provider’s dynamic nature can enable rapid deployment of new malicious pages under the same account. Organizations should also verify that users are educated about unsolicited links that resolve to obscure subdomains, as the naming pattern offers no legitimate brand association. In summary, the domain’s registration, blocklist citations, and multi‑vendor detections collectively substantiate a genuine phishing threat; immediate containment and ongoing surveillance are recommended.