sp12ct-pravsen-biz-zomvik-hardel[.]pages[.]dev

This domain, sp12ct-pravsen-biz-zomvik-hardel.pages.dev, is actively flagged as a phishing threat targeting login credentials. Analysis indicates an elevated risk level, with 14 of 91 security vendors on VirusTotal detecting malicious activity linked to this domain. It appears on two security blocklists, including PhishDestroy and OpenPhish, which explicitly classify it as a phishing site.

The infrastructure is hosted on Cloudflare Pages, a common platform for rapid deployment of phishing campaigns due to its free tier and ease of use, though this alone does not confirm malicious intent. No specific brand or service is confirmed as the target based on available data, and the exact content of the site remains unanalyzed; however, the domain structure suggests an attempt to appear legitimate through obfuscation or randomized subdomains. Defenders should treat this domain as compromised and prioritize blocking it at the network level.

The presence on multiple blocklists and detections from security vendors provide concrete evidence of malicious intent, though further investigation—such as HTTP response analysis, SSL certificate inspection, or sandboxing—could yield additional indicators. Given the domain’s active status and the volume of detections, it is advisable to monitor for related infrastructure, such as IP addresses or ASNs associated with the hosting provider, and to alert users to avoid interaction. No registration or creation date is provided, limiting temporal analysis, but the current detections and blocklist status confirm ongoing risk.