sp12ct-karmor-biz-frensel-holdik[.]pages[.]dev

The domain sp12ct-karmor-biz-frensel-holdik.pages.dev was observed on August 07, 2026 and is currently classified as a generic phishing threat with an elevated risk rating. Infrastructure analysis shows that the domain resolves to the IPv4 address 172.66.47.13, a server that is shared by other cloud‑hosted sites on the same provider. The domain has been listed by the PhishDestroy blocklist and appears on a single additional security blocklist, indicating that at least one external sinkhole or filtering service has taken action against it.

VirusTotal scans returned 13 positive detections out of 91 security vendors, confirming that multiple anti‑malware engines have flagged the host as malicious. No further contextual data such as registrar details, SSL certificate attributes, or HTTP response codes were supplied, leaving the registration profile and transport‑layer security posture unknown. The limited visibility suggests that the site may be a short‑lived dropper or a re‑used sub‑domain within a larger hosting ecosystem.

Defenders should block the domain and its resolved IP at perimeter firewalls, update DNS‑based deny lists, and monitor for any related query spikes that could indicate payload distribution. Continuous re‑assessment is advised, as the lack of comprehensive metadata means the operational lifespan and targeting scope cannot be precisely determined at this time.