sp12ct-vardor-biz-helsik-zamnor[.]pages[.]dev

Analysis of sp12ct-vardor-biz-helsik-zamnor.pages.dev indicates that the domain is actively used in a phishing operation. The site is registered through Cloudflare Pages, a serverless hosting platform that often masks the underlying infrastructure and can make IP attribution difficult. The domain has been added to two security blocklists and is specifically flagged by the PhishDestroy and OpenPhish blocklist providers, confirming its presence on curated phishing feeds.

VirusTotal reports that 14 of 91 security vendors have flagged the domain as malicious, reinforcing the consensus that it is being leveraged for fraudulent purposes. No public SSL certificate details, HTTP response codes, or page title information are currently available, leaving those aspects of the infrastructure unverified. The lack of disclosed page title or content suggests that the site either serves dynamically generated pages or that its content has not been captured by public scanners.

Defenders should treat the domain as high‑risk: it should be blocked at the DNS and proxy layers, added to URL filtering rules, and monitored for any changes in hosting or certificate data. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds will help maintain visibility as the threat actor potentially evolves the hosting setup. Given the elevated risk rating and active status, proactive containment is advisable to prevent credential harvesting or other phishing‑related compromises.