sp12ct-framik-biz-zensor-kaldok[.]pages[.]dev

The domain sp12ct-framik-biz-zensor-kaldok.pages.dev is currently active and has been classified as a generic phishing site with an elevated risk rating. VirusTotal scans show that 14 of 91 security vendors flag the domain as malicious, indicating a moderate consensus of detection. The domain is listed on at least one external security blocklist and is actively blocked by the PhishDestroy filtering service. DNS resolution points to the IPv4 address 172.66.47.4; no additional IP aliases or CDN front‑ends have been observed. The hosting location, ASN, or country of the IP address have not been disclosed in the available intelligence, so further network‑level profiling is required.

At present, no public Safe Browsing, OTX, or SSL certificate details have been published for the domain, and the page title or any brand references have not been captured. Consequently, the exact phishing campaign vector—such as credential harvesting pages, redirect behavior, or payload delivery—remains unknown. The lack of visible webpage metadata limits the ability to attribute the infrastructure to a specific threat actor or to correlate it with known phishing kits. Defenders should add the domain to DNS and URL filtering policies, enforce blocklists that include it, and monitor outbound connections to 172.66.47.4. Continuous re‑scanning on VirusTotal and similar platforms is advised to capture any changes in vendor detections.

Network traffic analysis should be used to detect any attempts to retrieve resources from the domain, and endpoint protection solutions should be updated to reflect the current vendor consensus. Because the domain is still active, rapid containment of any user‑initiated requests is recommended to prevent credential compromise. Given the limited public footprint, threat intel teams should consider performing manual HTTP probing in a sandboxed environment to capture response headers, redirect chains, and any embedded malicious scripts.