sp12ct-dravik-biz-zemlor-parsok[.]pages[.]dev

This domain, sp12ct-dravik-biz-zemlor-parsok.pages.dev, is flagged as a generic phishing threat as of August 07, 2026. VirusTotal data shows 13 of 91 security vendors currently flag the domain as malicious, and it appears on one security blocklist maintained by PhishDestroy. The domain resolves to IP address 172.66.47.74. Infrastructure analysis indicates the domain is hosted on a Cloudflare Pages subdomain, which is a common free web hosting service used by attackers to quickly deploy phishing pages with minimal cost and registration friction. The specific page content has not been analysed in the available intelligence, so the exact brand impersonated, if any, and the precise scam type (e.g., credential harvesting, payment fraud) remain uncertain.

Defenders should treat this domain as actively hostile. Given the 13 vendor flags and the blocklist presence, network administrators should block the domain at DNS and proxy levels to prevent user access. Email security gateways should also quarantine any messages containing links to this domain. Since the domain is hosted on a legitimate service (Cloudflare Pages), takedown may require reporting to Cloudflare's abuse team, providing the VirusTotal evidence and the PhishDestroy blocklist reference. Although the page content is unverified, the high vendor detection rate strongly suggests malicious intent.

Defenders should also monitor for related subdomains under the same parent pages.dev namespace, as attackers often create multiple similar domains for campaign redundancy. No SSL certificate details, registrar information, or HTTP status codes were available in the supplied intelligence, so those checks remain outstanding. It is recommended to perform a live fetch from a sandboxed environment to capture the page title, HTTP response, and any redirects, then submit that evidence to VirusTotal and relevant blocklists. Until then, treat any interaction with this domain as a security incident.