sp12ct-foldor-biz-zarnik-mavsel[.]pages[.]dev

The domain sp12ct-foldor-biz-zarnik-mavsel.pages.dev is currently classified as an active generic phishing infrastructure with an elevated risk rating. Evidence from open‑source blocklists shows the domain is listed on two separate security blocklists and has been explicitly blocked by the PhishDestroy and OpenPhish feed providers, indicating that multiple phishing‑focused detection services have observed malicious activity originating from this host. Registration data confirms the domain was provisioned through Cloudflare Pages, a legitimate static‑site hosting service that is frequently abused to provide fast‑changing URLs and to obscure the true origin of malicious content.

VirusTotal analysis reports that 15 of 91 security vendors flagged the domain, reinforcing the suspicion that the site is being used for malicious purposes. No public page title or content snapshot is presently available, so the exact look‑and‑feel of the landing page cannot be described; analysts should treat the lack of visual evidence as a gap that warrants further active probing when safe. The combination of blocklist inclusion, targeted phishing feeds, and multi‑vendor detection strongly suggests the domain is being leveraged to host credential‑harvesting pages or other deceptive content.

Defenders are advised to add the domain to outbound filtering rules, monitor DNS queries for resolutions to Cloudflare infrastructure, and consider temporary sinkholing until the threat actor’s activity subsides. Continuous re‑evaluation is recommended, as future scans may reveal additional indicators such as SSL certificate details, HTTP response codes, or page metadata that could refine the risk assessment.