sp5ct-lorek-biz8-hurem-savix[.]pages[.]dev

On 3 August 2026, the domain sp5ct-lorek-biz8-hurem-savix.pages.dev was identified as an active generic phishing infrastructure with an elevated risk rating. The site is hosted on Cloudflare Pages, as indicated by the registrar information, and therefore benefits from Cloudflare’s global edge network and SSL termination. The domain has been added to one public security blocklist and is currently blocked by the PhishDestroy feed, demonstrating that at least one reputable anti‑phishing service has taken mitigation action.

VirusTotal analysis shows that 13 of 91 scanned security vendors have flagged the domain as malicious, providing independent confirmation of its malicious intent. No additional contextual data such as page title, target brand, or specific phishing kit is available at this time, leaving the exact content of the hosted page unverified. The lack of disclosed IP address or autonomous system information limits deeper infrastructure profiling, but the Cloudflare Pages hosting implies the underlying IPs belong to Cloudflare’s shared pool.

Defenders should add the domain to local blocklists, enforce DNS‑level filtering, and monitor outbound traffic for connections to the Cloudflare edge network associated with this hostname. Continuous re‑scanning on VirusTotal and periodic checks against threat‑intel feeds are recommended to capture any changes in detection scores or new blocklist listings. Because the domain is already marked as elevated risk and actively blocked by PhishDestroy, organizations should treat any inbound requests to this hostname as malicious and block them outright.