sp12ct-holrek-biz-pranik-keldar[.]pages[.]dev

This domain, sp12ct-holrek-biz-pranik-keldar.pages.dev, is currently flagged as an active phishing threat targeting cloud service credentials. Analysis indicates the domain is hosted on Cloudflare Pages (pages.dev), a common infrastructure choice for attackers due to its free, ephemeral hosting capabilities. As of August 03, 2026, the domain is detected by 14 of 91 security vendors on VirusTotal, a notable detection rate that aligns with elevated risk classifications. It is explicitly blocked by PhishDestroy and OpenPhish, and appears on two additional security blocklists, reinforcing its malicious classification. Infrastructure analysis reveals the domain resolves to Cloudflare IP space, consistent with legitimate and malicious sites alike, offering limited attribution value.

The use of a .pages.dev subdomain suggests rapid deployment and low-cost hosting, typical of phishing campaigns designed for short-term use. No specific brand impersonation is confirmed in the available data; however, the domain's structure and hosting pattern are consistent with credential-harvesting portals targeting enterprise cloud services. The exact content of the site remains unanalysed, and no page title or phishing kit details are available at this time. Defenders should treat this domain as an active threat. Blocking at the DNS or network level is recommended, particularly for organisations using cloud-based authentication services.

Security teams are advised to monitor for connections to this domain in proxy logs, endpoint telemetry, and email filtering systems. If credentials were entered on this site, immediate password resets and multi-factor authentication reviews are critical. Given the domain's presence on multiple blocklists, automated threat feeds should be updated to include this indicator. Further analysis of the site's content may reveal additional indicators of compromise or targeted brands.