sp12ct-forsor-biz-kandel-vazmik[.]pages[.]dev

Analysis as of August 07, 2026 indicates that the domain sp12ct-forsor-biz-kandel-vazmik.pages.dev is actively used in a phishing campaign. The domain resolves to the IPv4 address 172.66.44.179, which is the sole hosting indicator available. The domain has been added to one external security blocklist and is specifically listed by the PhishDestroy mitigation platform, confirming that it is recognized as malicious by at least one dedicated anti‑phishing service. VirusTotal records show that 13 of 91 security vendors have flagged the domain as malicious, suggesting a moderate consensus among scanning engines.

No additional contextual data such as registrar information, SSL certificate details, or HTTP response codes were provided, leaving the broader infrastructure profile undefined. Because the page title and targeted brand have not been disclosed, the precise phishing vector cannot be confirmed, and analysts should treat the domain as a generic phishing endpoint until further content analysis is performed. The current risk rating is elevated and the status is active, meaning the domain is still reachable and may be delivering fraudulent content.

Defenders should immediately block the domain at network perimeter devices, update DNS filtering policies to include the identified IP address, and monitor for any outbound connections to the host. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in detection rates, and any observed traffic should be logged for further forensic correlation. Organizations that employ email gateway filtering should add the domain to deny lists to prevent malicious links from reaching end users.