sp11ct-solnix-biz8-venkar-morlek[.]pages[.]dev

sp11ct-solnix-biz8-venkar-morlek.pages.dev is currently listed as an active generic phishing infrastructure (seed 4c88c7). Google Safe Browsing classifies the domain as a social engineering threat, and two independent security blocklists have added it to their deny lists. Both PhishDestroy and OpenPhish explicitly block the domain, indicating that it has been observed delivering fraudulent credential‑collection pages. VirusTotal analysis shows that 16 of 91 scanning engines returned a malicious verdict, reinforcing the suspicion of malicious intent.

The domain is hosted on Cloudflare Pages, a static‑site service that often provides legitimate SSL certificates and hides the underlying origin IP, which complicates attribution. No additional intelligence such as ASN, geographic location, or SSL fingerprint is available beyond the Cloudflare Pages registrar information. The observable evidence therefore consists of the Safe Browsing flag, the presence on multiple blocklists, and the VirusTotal detection count.

While the exact content of the site has not been publicly disclosed, the convergence of these indicators suggests a high‑confidence phishing operation. Defenders should block the domain at network perimeter, update intrusion‑detection signatures, and monitor for any traffic to the associated Cloudflare edge nodes. Continuous re‑scanning on VirusTotal and periodic checks against Google Safe Browsing are recommended to capture any changes in the domain’s classification.