sp12ct-varkel-biz-frensok-ladmor[.]pages[.]dev

This domain sp12ct-varkel-biz-frensok-ladmor.pages.dev is actively serving content hosted on Cloudflare Pages. DNS resolution points to IP 172.66.46.234, which belongs to Cloudflare's edge network. The domain is listed on a single security blocklist and is also blocked by the PhishDestroy feed, indicating that at least one anti‑phishing service has identified malicious activity. VirusTotal has analysed the hostname and 14 of 91 scanned security vendors returned a positive detection, reinforcing the suspicion of phishing‑related abuse.

The presence of multiple detections across independent scanners suggests a non‑trivial likelihood of phishing‑related payloads, although the exact page content and target brand have not been disclosed in the available data set. No Safe Browsing or Open Threat Exchange (OTX) entries are currently referenced, and no SSL certificate details, HTTP response codes, or page title information have been published, leaving those vectors unverified. Defenders should therefore treat the domain as hostile: block DNS resolution and HTTP(S) traffic to 172.66.46.234, add the fully qualified name to proxy and firewall deny lists, and monitor for any authentication attempts or credential submissions that may be directed at the site.

Continuous re‑evaluation is advised, as further analysis of the landing page could reveal additional indicators such as credential‑stealing forms or malicious redirects. Organizations employing threat‑intel platforms should ingest the VirusTotal detection count and the PhishDestroy blocklist entry to enrich existing detection rules. Until a definitive payload is observed, the recommendation remains to enforce a deny‑by‑default stance for this domain across enterprise networks.