sp12ct-farsel-biz-kormik-holdar[.]pages[.]dev

The domain sp12ct-farsel-biz-kormik-holdar.pages.dev has been confirmed as an active phishing operation as of August 03, 2026. Security intelligence sources indicate it is currently blocked by both PhishDestroy and OpenPhish, two established anti-phishing blocklists. The domain appears on at least two known security blocklists, reinforcing its status as a recognized threat within the security community. VirusTotal analysis shows that 14 out of 91 security vendors have flagged this domain for malicious activity, indicating a consensus among industry-leading threat detection systems.

The domain is registered via Cloudflare Pages, a popular hosting provider that is occasionally abused for phishing infrastructure due to its ease of deployment and free tier services. At this time, no specific information is available regarding the targeted brand, page title, or the visual content presented to visitors; therefore, the exact nature of the phishing attempt remains undetermined beyond its generic classification. There is no evidence provided for SSL certificate details, IP address, hosting ASN, or country of origin.

Defenders should immediately block and monitor for any access to this domain within their networks, as its presence on multiple blocklists and detection by a significant number of security vendors indicates elevated risk. Further analysis may be required to determine if this domain is part of a larger phishing campaign or linked infrastructure. Continued vigilance and automated threat intelligence updates are recommended, as the domain remains active and may continue to be used for malicious purposes.