sp12ct-varsel-biz-framik-holdor[.]pages[.]dev

Analysis indicates that sp12ct-varsel-biz-framik-holdor.pages.dev is an active malicious infrastructure observed as a generic phishing site. The domain is hosted on Cloudflare Pages, a service that provides static site hosting and DNS resolution. DNS resolution returns a single IPv4 address, 172.66.44.186, which is owned by Cloudflare’s edge network.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy filtering service, confirming that at least one commercial anti‑phishing vendor has flagged the host as malicious. No additional intelligence such as page title, SSL certificate details, or content snapshots is available at this time, so the exact phishing lure and targeted brand remain undefined. The lack of public scans or community reports suggests limited exposure, but the active status and blocklist presence warrant immediate defensive action.

Defenders should add the domain and its resolved IP address to network‑level deny lists, configure DNS sink‑hole rules, and ensure that endpoint web filters reference the PhishDestroy feed. Continuous monitoring for any new detections, changes in blocklist membership, or additional hosting identifiers is recommended. Until further analysis clarifies the specific credential‑harvesting vectors, the domain should be treated as a high‑confidence phishing threat.