sp11ct-selvik-biz8-tormex-janlor[.]pages[.]dev

The domain sp11ct-selvik-biz8-tormex-janlor.pages.dev is currently listed as active and classified as a generic phishing site with an elevated risk rating. Registration details show the hostname is served from Cloudflare Pages, indicating the attacker leveraged Cloudflare’s free static‑site hosting to obtain a legitimate TLS certificate without exposing underlying server infrastructure. The domain appears on two public security blocklists and is explicitly blocked by both PhishDestroy and OpenPhish, confirming its presence in established anti‑phishing feeds.

VirusTotal analysis reports that 14 of 91 scanned security vendors flagged the domain as malicious, providing independent confirmation of its malicious nature. No additional intelligence such as ASN, country, or payload details is available at this time, so the full scope of the phishing campaign remains uncertain. Defenders should continue to block the hostname at perimeter filters, update DNS sinkhole entries, and monitor for any traffic toward the associated Cloudflare edge IP ranges.

Because the site is hosted on a shared platform, any remediation that isolates the domain from Cloudflare’s network is unlikely to succeed; instead, enforcement should rely on threat‑intel feeds and URL filtering. Organizations are advised to educate end users about the risk of unsolicited login prompts that may reference the domain, and to enforce multi‑factor authentication to mitigate credential compromise. Ongoing observation of the domain’s activity and periodic re‑scans with VirusTotal are recommended to capture any changes in detection scores.