sp11ct-lavrik-biz8-kornel-tresan[.]pages[.]dev

Analysis for sp11ct-lavrik-biz8-kornel-tresan.pages.dev was completed on August 03, 2026. The domain is currently classified as an active generic phishing site with an elevated risk rating. VirusTotal has recorded detections from 12 of 91 scanned security vendors, indicating that a subset of scanners identified malicious behavior. Independent phishing‑tracking services PhishDestroy and OpenPhish have already added the domain to their blocklists, and it is also present on two additional public blacklist feeds. These confirmations collectively demonstrate that the domain is being used to lure victims into credential‑harvesting interactions.

Infrastructure details beyond the domain name are not publicly disclosed in the available intelligence. No information on the registrar, registration date, hosting IP address, ASN, or SSL certificate status has been provided, and no Safe Browsing or AlienVault OTX entries are referenced. The HTTP response code, page title, and any associated trust‑score metrics are therefore unknown at this time. Because the observable evidence is limited to detection counts and blocklist inclusions, the confidence in the phishing attribution rests primarily on the vendor flags and the explicit blocklist entries. Defenders should treat the domain as hostile.

Immediate mitigation steps include adding the domain to network‑level deny lists, configuring browser security extensions to block it, and ensuring that email gateways quarantine any messages containing the URL. Continuous monitoring of the domain’s activity is recommended, as additional infrastructure attributes such as hosting IP or SSL fingerprint may become available in future feeds. Organizations that employ threat‑intelligence platforms should ingest the blocklist identifiers from PhishDestroy and OpenPhish to automate protection. Until further forensic data is released, the domain should remain blocked to prevent credential compromise.