sp5ct6-fralnex-biz-dravqor-vraxtik[.]pages[.]dev

Analysis indicates that the domain sp5ct6-fralnex-biz-dravqor-vraxtik.pages.dev is actively being used for malicious activity classified as generic phishing. The domain was created on 2026-06-04 and is hosted on Cloudflare Pages, resolving to the IPv4 address 172.66.46.244. VirusTotal reports that 12 of 91 scanning engines have flagged the domain as malicious, suggesting a consensus among a subset of security vendors that the site delivers phishing content or related threats. The domain appears on one external blocklist and has been explicitly blocked by the PhishDestroy mitigation platform, reinforcing its reputation as a harmful resource. Risk scoring assigned by the reporting system is elevated, and the current operational status is active, meaning the site is reachable and may still be serving malicious payloads.

The registration through Cloudflare Pages implies that the attacker leveraged a legitimate, high-reputation content-delivery service to obscure infrastructure details and benefit from Cloudflare’s built-in performance and DDoS protection. The single blocklist entry, while limited in number, aligns with the detection count from VirusTotal and demonstrates that at least one independent threat-intelligence feed has recognized the domain as abusive. No additional public intelligence such as Safe Browsing, OTX, or SSL certificate details have been disclosed, leaving those vectors unverified. Defenders should prioritize immediate containment by adding the domain to local deny lists and enforcing outbound DNS filtering.

Network monitoring should include traffic to the resolved IP address 172.66.46.244, as any connections may indicate compromised client activity. Continuous re-scanning with VirusTotal or similar multi-engine platforms is advised to capture any changes in vendor detections.