sp11ct-zenril-biz8-dorvak-plenor[.]pages[.]dev

sp11ct-zenril-biz8-dorvak-plenor.pages.dev is currently listed as an active generic phishing site with an elevated risk rating. The domain was provisioned through Cloudflare Pages, indicating that the underlying infrastructure consists of Cloudflare’s static‑site hosting platform and that TLS termination is managed by Cloudflare’s edge network. Detection services have identified malicious activity: fifteen of ninety‑one VirusTotal scanners flagged the domain, and it is present on two independent blocklists, specifically PhishDestroy and OpenPhish.

These listings confirm that security vendors have observed phishing‑related behavior associated with the URL. No public Safe Browsing or OTX entries were referenced in the available intelligence, and no page title or content snapshot has been published, leaving the exact visual presentation of the site unknown. The lack of additional metadata such as IP address, ASN, or country limits a deeper infrastructure fingerprint, but the Cloudflare Pages registration alone provides sufficient context for defensive controls.

Defenders should immediately add the full hostname to network‑level deny lists, enforce URL filtering rules to block HTTP and HTTPS requests to the domain, and monitor outbound traffic for any connections to Cloudflare edge nodes that resolve to this host. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the domain’s payload or hosting configuration. Given the active status and the multiple vendor detections, the domain should be treated as a confirmed phishing threat until it is taken down or the listings are removed.