sp12ct-fandor-biz-hesvik-kormel[.]pages[.]dev

The domain sp12ct-fandor-biz-hesvik-kormel.pages.dev is currently listed as active malicious infrastructure. Its DNS resolves to Cloudflare Pages, indicating the site is served from a Cloudflare‑managed hosting environment. The domain appears on two public phishing blocklists, specifically PhishDestroy and OpenPhish, both of which have actively blocked the host.

VirusTotal scans show that 14 out of 91 security vendors have flagged the domain as malicious, reinforcing the blocklist evidence. No additional contextual data such as page title, target brand, or SSL certificate details have been released, so the precise phishing campaign payload remains unknown. The limited public intelligence suggests a generic phishing operation, but the convergence of multiple independent detections raises the confidence that the site is being used to harvest credentials or deliver malicious payloads.

Defenders should add the FQDN to network‑level deny lists, include it in URL filtering policies, and monitor for any outbound connections to the associated Cloudflare edge IP ranges. Continuous re‑scanning on VirusTotal and periodic checks of blocklist status are recommended to capture any changes in detection scores. Until further forensic artefacts are disclosed, the domain should be treated as high‑risk and blocked in enterprise environments.