sp12ct-kramel-biz-fondor-lesvik[.]pages[.]dev

sp12ct-kramel-biz-fondor-lesvik.pages.dev is currently listed as an active generic phishing site with an elevated risk rating. The domain appears on two public blocklists and has been explicitly flagged by PhishDestroy and OpenPhish, indicating that both services have observed malicious activity originating from this host. VirusTotal analysis shows that 15 of 91 scanned security vendors identified the domain as malicious, reinforcing the blocklist findings.

No additional infrastructure details such as registrar, IP address, hosting provider, SSL certificate information, or HTTP response codes have been disclosed, so the underlying server location and network attributes remain unknown. The absence of public Safe Browsing or OTX entries suggests that the domain has not yet been incorporated into those feeds, but the existing blocklist and VirusTotal detections provide sufficient evidence for immediate defensive action. Defenders should add the full hostname to DNS and URL filtering policies, ensure that any outbound email filters block links to the domain, and monitor network traffic for attempted connections to the pages.dev hosting domain.

Continuous re‑evaluation is advised, as further analysis may reveal hosting patterns or additional malicious payloads. Until more concrete hosting data becomes available, the recommendation is to treat any communication referencing this domain as hostile and to quarantine or discard associated messages.