sp12ct-kamvik-biz-zornel-hesdor[.]pages[.]dev

This domain, sp12ct-kamvik-biz-zornel-hesdor.pages.dev, is currently classified as an active generic phishing site with an elevated risk rating. Registration records show that the domain is hosted on Cloudflare Pages, a serverless hosting service frequently abused for short‑lived phishing infrastructure. The domain is listed on two reputable security blocklists and has been explicitly blocked by PhishDestroy and OpenPhish, indicating that multiple threat‑intelligence feeds have observed malicious activity linked to it.

VirusTotal analysis reports that 15 out of 91 scanned scanners flagged the domain as malicious, reinforcing the consensus that the site is used for credential harvesting or similar fraud. Publicly available telemetry does not reveal the underlying IP address, TLS certificate details, or HTTP response codes, and the page title has not been disclosed. Consequently, investigators cannot confirm the exact landing page content or the targeted brand, though the generic phishing label suggests a credential‑stealing campaign rather than a specialized scam.

Defenders should continue to block the domain at the DNS layer, update web‑filtering policies, and monitor outbound connections for traffic to the *.pages.dev suffix. Because the domain is hosted behind Cloudflare’s CDN, direct takedown may be limited; coordinated reporting to Cloudflare Abuse and the blocklist operators is recommended to accelerate remediation. Ongoing monitoring of VirusTotal and other sandbox feeds is advised to capture any changes in detection scores or new indicator sets.