sp11ct-helnor-biz8-zarsik-folmer[.]pages[.]dev

The domain sp11ct-helnor-biz8-zarsik-folmer.pages.dev is currently active and classified as elevated‑risk generic phishing. It is hosted on Cloudflare Pages, indicating the underlying infrastructure is provided by Cloudflare’s static‑site service. The domain has been added to two public security blocklists and is explicitly listed by PhishDestroy and OpenPhish as a malicious phishing host.

VirusTotal has recorded detections from 15 of 91 scanned security vendors, confirming that a notable subset of scanners consider the site malicious. No public WHOIS details beyond the Cloudflare Pages registrar are available, and no IP address, SSL certificate metadata, or HTTP response codes have been disclosed in the intelligence feed. Consequently, the precise hosting IP, TLS configuration, and page content remain unverified.

Analysts should treat any traffic to this domain as hostile, block it at perimeter firewalls and DNS resolvers, and monitor for related indicators such as the same Cloudflare Pages sub‑domain pattern. Because the site’s payload and target brand have not been published, threat hunters should prioritize correlation with credential‑theft logs and email phishing campaigns that reference the same domain pattern. Ongoing collection of page title, response headers, and any observed redirects will be essential for refining detection rules.