sp12ct-kamvik-biz-prondor-hazsel[.]pages[.]dev

The domain sp12ct-kamvik-biz-prondor-hazsel.pages.dev is provisioned through Cloudflare Pages, a static‑site hosting service that issues domains under the pages.dev suffix. Infrastructure analysis shows no unique IP address or ASN information beyond the default Cloudflare edge network, which limits attribution of the underlying server. The domain appears on a single security blocklist and has been explicitly flagged by the PhishDestroy mitigation service, indicating that at least one reputable anti‑phishing feed has classified it as malicious. VirusTotal has processed the domain and 10 of 91 scanned security vendors returned a positive detection, reinforcing the blocklist signal.

The detection count suggests that multiple independent scanners have identified suspicious or malicious characteristics, although the specific signatures or heuristics employed are not disclosed. Publicly available metadata does not include a page title, SSL certificate details, or HTTP response codes, so the exact content served by the site remains unverified. Consequently, the precise phishing vector—such as credential harvesting or credential‑stealing forms—cannot be confirmed from the current evidence set.

Defenders should treat the domain as hostile based on the convergent indicators from Cloudflare Pages registration, blocklist inclusion, PhishDestroy listing, and multi‑vendor detections. Recommended mitigations include adding the domain to DNS‑based blocklists, enforcing URL filtering at the proxy layer, and monitoring outbound traffic for connections to the Cloudflare edge network that resolve to this hostname. Continuous re‑evaluation is advised should additional intelligence, such as page content or SSL fingerprint, become available.