sp4ct-velrax-biz8-sorim-kanex[.]pages[.]dev

This domain, sp4ct-velrax-biz8-sorim-kanex.pages.dev, is hosted on Cloudflare Pages infrastructure (pages.dev) and is currently flagged as an active phishing endpoint by multiple security sources. Analysis indicates the domain appears on at least one security blocklist and is blocked by PhishDestroy, a specialized anti-phishing service. VirusTotal detection data shows 12 of 91 security vendors flagging the domain as malicious, providing concrete evidence of its association with phishing activity. The domain's structure—containing randomized subdomains and a Cloudflare Pages suffix—aligns with common phishing deployment patterns, where attackers leverage free hosting services to rapidly deploy and rotate malicious endpoints.

Infrastructure analysis reveals the domain is served via Cloudflare's content delivery network, which may obscure the origin server's IP and hosting provider details. No registrar or ASN information is currently available for this subdomain, as it inherits Cloudflare's infrastructure. The SSL certificate is valid and issued by Cloudflare, which does not inherently indicate malicious intent but is consistent with phishing domains exploiting legitimate CDN services. The HTTP status and page content have not been fully analyzed, though the domain's classification as a phishing endpoint suggests it likely hosts credential harvesting or fraudulent content.

Defenders should treat this domain as an elevated-risk phishing resource. Immediate actions include blocking the domain at the network level, monitoring for related subdomains or domains using similar naming conventions, and reviewing logs for connections to this endpoint. Given the domain's presence on security blocklists and detection by multiple vendors, organizations should prioritize remediation for any systems that have interacted with it.