sp12ct-varnik-biz-keldor-fresmik[.]pages[.]dev

Analysis of sp12ct-varnik-biz-keldor-fresmik.pages.dev indicates confirmed phishing activity with elevated risk as of August 3, 2026. The domain is hosted on Cloudflare Pages infrastructure, a common vector for rapidly deployed credential-harvesting sites. VirusTotal scanning reveals 15 of 91 security vendors flagging the domain, a detection rate consistent with known phishing pages rather than benign false positives. The domain appears on two security blocklists, including PhishDestroy and OpenPhish, both of which specialize in real-time phishing detection.

No specific brand impersonation or scam subtype is currently confirmed in the available data; the content of the page remains unanalyzed beyond its classification as generic phishing. The domain's structure—using hyphenated, seemingly randomized subdomains—aligns with patterns observed in automated phishing kits designed to evade basic keyword filtering. Cloudflare's registrar role suggests the domain was registered recently or automatically, though exact registration details are not provided in the intelligence. Defenders should treat this domain as active and malicious.

Blocking at the DNS or proxy level is recommended, particularly for organizations with users susceptible to credential theft. Network logs should be reviewed for connections to this domain, and any credentials entered on the site should be considered compromised. Further analysis of the page's HTML or JavaScript may reveal additional indicators, such as redirect chains or embedded malicious scripts, but such examination is not yet documented in the available evidence.