smsnator[.]online

Analysis of smsnator.online shows an active high‑risk generic phishing infrastructure. The domain resolves to 104.21.61.22, a Cloudflare‑served address located in Canada, and uses Cloudflare nameservers aaden.ns.cloudflare.com and marjory.ns.cloudflare.com. Registration data indicates the domain was created on September 13, 2022 through Hostinger UAB. SSL is provided by Google Trust Services (WE1) and the site returns HTTP 200 with a page title of "Receive SMS Online | Temporary Disposable Phone Number," suggesting the site is positioned as a disposable phone‑number service. Security telemetry records three of ninety‑one VirusTotal scanners flagging the domain, it appears on one external blocklist, and PhishDestroy has already blocked it. Detected technologies include LivePerson, Google Analytics, Google AdSense, Funding Choices, Cloudflare Browser Insights, and HTTP/3, all typical of publicly accessible sites hosted on a CDN. The Gridinsoft trust score of 41/100 further indicates low confidence in the host. While the exact phishing payload or credential‑collection mechanisms have not been observed, the combination of a deceptive service title, active hosting, and multiple vendor detections confirms a malicious intent aimed at credential harvesting. Defenders should add smsnator.online to URL filtering and domain block lists, monitor DNS queries for the associated Cloudflare IP, and enforce outbound traffic controls that prevent connections to this domain. Continuous re‑scanning of the host and tracking of any new detections are recommended to maintain situational awareness.