sp12ct-vomsar-biz-zelnik-prandel[.]pages[.]dev

sp12ct-vomsar-biz-zelnik-prandel.pages.dev is currently listed as an active generic phishing infrastructure. The domain is hosted on Cloudflare Pages, indicating the use of a serverless web‑hosting platform that masks the underlying IP address behind Cloudflare’s network. VirusTotal has recorded detections from 14 of 91 scanning engines, demonstrating that multiple security products have identified the site as malicious. Independent phishing‑specific blocklists have also taken action: PhishDestroy and OpenPhish both include the domain, and it appears on two additional security blocklists.

These listings corroborate the classification and suggest that the domain is being actively used to distribute fraudulent content. No public SSL certificate details, HTTP status codes, or page‑title information have been disclosed, limiting the depth of technical fingerprinting. Consequently, while the presence on reputable blocklists and the multi‑vendor VirusTotal detections provide strong evidence of malicious intent, the exact payload, targeted brand, or victim interaction flow remain unknown.

Defenders should block the domain at perimeter firewalls, DNS resolvers, and proxy filters, and update any threat‑intel feeds with the observed indicators. Continuous monitoring of Cloudflare Pages registrations for similar sub‑domain patterns is recommended, as the platform can be leveraged to spin up short‑lived phishing sites. Organizations should also consider sharing any future observations, such as HTTP response headers or page titles, with community blocklist operators to improve collective detection.