sp11ct-dravon-biz8-kelsor-mazvik[.]pages[.]dev

Analysis indicates that sp11ct-dravon-biz8-kelsor-mazvik.pages.dev is an active phishing domain hosted on Cloudflare Pages infrastructure. As of August 3, 2026, the domain is flagged by 15 out of 91 security vendors on VirusTotal, a detection rate that meets the threshold for elevated risk. Two independent blocklists—PhishDestroy and OpenPhish—have already listed the domain, reinforcing its classification as malicious. The domain appears on two additional security blocklists, though specific names are not disclosed in available data.

Infrastructure analysis reveals the domain is registered through Cloudflare Pages, a platform commonly used for static site hosting but also frequently abused for phishing due to its free, low-friction deployment. No brand target, phishing kit, or page title is currently available in public feeds, so the exact content or intended victim group remains unconfirmed. The domain has not been linked to a specific scam type (e.g., credential harvesting, financial fraud, or brand impersonation) based on current intelligence. Defenders should treat this domain as a confirmed phishing threat.

Recommended actions include blocking the domain at the DNS or proxy level, adding it to endpoint protection denylists, and monitoring for connections from internal networks. If internal access logs show traffic to this domain, initiate incident response procedures for potential credential compromise or malware exposure. Given the domain’s Cloudflare Pages origin, defenders may also consider monitoring for similar patterns (e.g., subdomains with randomized strings) as part of proactive threat hunting.