sp12ct-hamrel-biz-pronsik-keldor[.]pages[.]dev

The domain sp12ct-hamrel-biz-pronsik-keldor.pages.dev is currently active and has been classified as a generic phishing site. Infrastructure analysis shows the domain is provisioned through Cloudflare Pages, indicating it relies on Cloudflare’s edge network for hosting and content delivery. VirusTotal reports that 14 of 91 security vendors have flagged the domain, providing a modest but notable detection signal across multiple scanning engines. The domain also appears on two external blocklists, specifically PhishDestroy and OpenPhish, both of which are incorporated into many enterprise web‑filtering solutions.

These blocklist entries reinforce the phishing classification and suggest that the domain is already recognized by threat‑intelligence feeds. No additional public data such as IP address, SSL certificate details, HTTP response codes, Safe Browsing status, or page title has been disclosed; consequently, the exact hosting IP, TLS configuration, and page content remain unverified. Given the elevated risk rating, defenders should prioritize immediate mitigation.

Recommended actions include adding the domain to DNS‑level deny lists, updating proxy and firewall rules to block traffic to the domain, and ensuring that any existing URL filtering solutions ingest the PhishDestroy and OpenPhish feeds. Continuous monitoring for DNS queries or outbound connections to the domain is advisable, as is periodic re‑scanning to capture any changes in detection status. Until further forensic evidence is gathered, the domain should be treated as a confirmed phishing vector with a high likelihood of credential‑stealing or malicious redirection.