sp12ct-lavrik-biz-kersel-frondak[.]pages[.]dev

On August 07, 2026, the domain sp12ct-lavrik-biz-kersel-frondak.pages.dev was recorded as an active generic phishing infrastructure with an elevated risk rating. The site is hosted on Cloudflare Pages, as indicated by the registrar information, and resolves to the IPv4 address 172.66.47.167. Infrastructure analysis shows that the host is currently listed on a single security blocklist and has been blocked by the PhishDestroy feed, confirming that defensive platforms are already recognizing the malicious activity.

VirusTotal has processed the domain and 14 of 91 security vendors have returned positive detections, reinforcing the suspicion of phishing behavior. No additional public blocklist entries or Safe Browsing alerts are present beyond the single blocklist entry. The domain’s page title, SSL certificate details, and any brand targeting information have not been disclosed in the available intelligence, leaving those aspects unverified.

Defenders should continue to enforce existing blocklist rules, add the domain to local deny lists, and monitor traffic to the IP 172.66.47.167 for anomalous patterns. Given the confirmed detections and active status, organizations are advised to treat any communications referencing this domain as malicious and to educate users about the risk of unsolicited requests that may direct them to this URL.