sp4ct-velnor-biz8-carex-dolim[.]pages[.]dev

Analysis of sp4ct-velnor-biz8-carex-dolim.pages.dev as of August 06, 2026 indicates that the domain is currently active and associated with a generic phishing threat. VirusTotal reports that 12 of 91 security scanners have flagged the domain, showing a moderate consensus among detection engines that the site hosts malicious content. The domain is listed on one security blocklist and is explicitly blocked by the PhishDestroy feed, reinforcing the assessment that it is being used for credential‑harvesting or similar phishing operations.

DNS resolution points to the IP address 172.66.47.150, a host commonly linked to cloud‑based page‑hosting services, which can simplify rapid deployment of phishing pages but also complicates attribution. The elevated risk rating assigned to the domain aligns with the detection count and blocklist presence, suggesting that defenders should treat traffic to this host as potentially hostile. No additional public intelligence such as registrar details, SSL certificates, HTTP response codes, or page titles is available at this time, leaving the exact content and targeted brand of the phishing campaign uncertain.

Defenders are advised to add 172.66.47.150 to network‑level deny lists, enforce DNS sinkholing for the full domain, and ensure that web‑proxy and email filtering solutions reference the PhishDestroy blocklist. Continuous monitoring of outbound connections to the IP and periodic re‑scans with VirusTotal are recommended to capture any changes in the domain’s behavior. Because the domain resides on the pages.dev sub‑domain space, organizations using similar cloud‑hosting services should consider implementing strict egress controls and user‑education campaigns focused on recognizing phishing attempts.