sp12ct-hersel-biz-lomdor-zafrik[.]pages[.]dev

The domain sp12ct-hersel-biz-lomdor-zafrik.pages.dev is currently listed as an active phishing infrastructure with an elevated risk rating. It appears on two public security blocklists and has been explicitly blocked by the PhishDestroy and OpenPhish feeds, indicating that both services have observed malicious activity originating from the host. VirusTotal analysis shows that 14 out of 91 scanning engines have generated a malicious verdict, reinforcing the suspicion that the site is being used for credential harvesting or other deceptive practices. No additional metadata such as registrar details, hosting IP, ASN, or SSL certificate information is available in the supplied intelligence, so the underlying infrastructure cannot be fully profiled at this time.

The lack of further context means that defenders cannot attribute the domain to a specific campaign or actor beyond its generic phishing classification. Given the confirmed blocklist listings and the multi‑engine detection count, security teams should immediately add the domain to their deny lists, enforce DNS sinkholing where possible, and monitor outbound traffic for attempts to resolve or contact the host. Continuous re‑evaluation is advised, as future scans may reveal additional indicators such as page titles, SSL fingerprints, or geolocation data that could refine response actions.

Analysts should also update endpoint protection rules to flag any URLs that resolve to the pages.dev sub‑domain pattern, as this suffix is frequently leveraged by adversaries to host disposable phishing pages. Organizations employing web‑proxy filtering should ensure that requests to this exact host are blocked and that any attempted authentication credentials captured by the site are considered compromised. Incident response teams should correlate any user reports of credential entry failures with this domain to confirm exploitation attempts.