sp12ct-zavmor-biz-pransik-holdek[.]pages[.]dev

The domain sp12ct-zavmor-biz-pransik-holdek.pages.dev has been flagged by multiple external threat intelligence sources as part of an active phishing campaign. Both PhishDestroy and OpenPhish have listed the domain in their malicious URL feeds, and it is currently present on two independent security blocklists. No additional infrastructure details such as registrar information, hosting IP addresses, ASN, or SSL certificate data have been disclosed in the available intelligence, limiting the depth of technical attribution at this stage.

The lack of public DNS or WHOIS data means that investigators cannot yet confirm the underlying hosting provider or geographic origin of the infrastructure. Likewise, the page title and any potential brand impersonation have not been captured, leaving the exact lure or credential‑harvesting vector undefined. Defenders should treat any network traffic to or from this domain as hostile.

Immediate actions include adding the domain to outbound web filtering rules, updating intrusion detection signatures to block HTTP/S requests, and ensuring that endpoint web protection solutions reference the latest blocklist feeds that contain this domain. Continuous monitoring for any new intelligence—such as resolved IP addresses, SSL certificate changes, or observed payloads—will be essential for refining response measures and assessing whether the campaign expands to additional domains or infrastructure components.