sp12ct-kandor-biz-frelvak-honsel[.]pages[.]dev

This domain, sp12ct-kandor-biz-frelvak-honsel.pages.dev, is flagged as an active phishing site by multiple security sources as of August 07, 2026. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages, a platform frequently exploited for phishing due to its ease of deployment and provision of free SSL certificates. The domain resolves to the IP address 172.66.46.216, which is part of Cloudflare's network infrastructure.

At the time of assessment, 14 out of 91 security vendors on VirusTotal have detected this domain as malicious, indicating a consensus among a subset of the security community regarding its fraudulent nature. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service. No additional details regarding the specific phishing kit, targeted brand, or page content are available in the current intelligence.

Defenders should treat this domain as a confirmed phishing threat with elevated risk due to its hosting on a legitimate but abused platform. Immediate action is recommended, including blocking the domain and IP at the network perimeter, updating endpoint protection rules, and monitoring for any internal connections to this infrastructure. Further investigation into related domains or IPs within Cloudflare's network may uncover additional malicious activity linked to this campaign.