sp12ct-kelvok-biz-zarmel-hentor[.]pages[.]dev

Analysis indicates that the domain sp12ct-kelvok-biz-zarmel-hentor.pages.dev is currently active and classified with an elevated risk rating for generic phishing. The domain resolves to the IPv4 address 172.66.44.186 and has been observed on a single security blocklist. Automated scanning on VirusTotal shows that 14 of 91 security vendors have flagged the domain as malicious, confirming the phishing classification. The blocklist entry from PhishDestroy also lists the domain as blocked, reinforcing the detection consensus.

No additional intelligence such as registrar details, SSL certificate information, HTTP response codes, or page title content is available in the current data set, leaving those aspects unverified. Because the domain is hosted on the pages.dev sub‑domain service, it inherits the underlying infrastructure of the provider, but the specific IP address is unique to this indicator. Defenders should immediately add the domain to deny lists at the DNS and proxy layers, and consider blocking the associated IP address 172.66.44.186 to mitigate potential credential harvesting attempts.

Continuous monitoring of the IP reputation and periodic re‑scanning with VirusTotal or similar multi‑engine services is recommended to capture any changes in detection coverage. Organizations that rely on web filtering should ensure the domain is included in their threat feeds, and incident response teams should treat any login attempts or credential submissions to this host as compromised. Until further forensic evidence is released, the precautionary stance should remain elevated.