sp5ct6-plaqtor-biz-fralvik-qravnex[.]pages[.]dev

The domain sp5ct6-plaqtor-biz-fralvik-qravnex.pages.dev was registered on 2026-06-04 through Cloudflare Pages and resolves to the IPv4 address 172.66.44.86. Early detection activity shows that 13 of 91 VirusTotal‑listed scanners have flagged the domain as malicious, indicating a moderate level of consensus among antivirus engines. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service is actively denying traffic to it. No additional public intelligence such as Safe Browsing alerts, OTX pulse references, or SSL/TLS certificate anomalies have been published for this host. The lack of a published page title or observed brand targeting suggests that the content has not yet been crawled or that the site is limited to a narrow distribution vector; consequently, the exact phishing lures, credential‑stealing forms, or targeted victim demographics remain unknown.

Infrastructure analysis indicates that the host is served from Cloudflare’s edge network, which can provide rapid content delivery and may obscure the true origin of the payload. The IP address 172.66.44.86 is associated with Cloudflare’s shared hosting pool rather than a dedicated server, which is typical for short‑lived phishing campaigns that rely on disposable domains. Defenders should add the domain to local blocklists and configure DNS filtering to drop queries for sp5ct6-plaqtor-biz-fralvik-qravnex.pages.dev. Network monitoring rules that flag outbound connections to the 172.66.44.86 address can help capture any attempted communications.

Incident response teams should treat any credential submissions to URLs under this domain as compromised and advise affected users to reset passwords immediately. Because the site is newly created and the public evidence base is limited, continuous re‑evaluation is advised.