c066b573[.]smrta[.]pages[.]dev

The domain c066b573.smrta.pages.dev was observed delivering a credential phishing campaign and has been taken offline as of the report date, July 23, 2026. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The hosting provider is Cloudflare, and the site was registered through Cloudflare, Inc., indicating the use of the provider's domain registration service. HTTP inspection returned a 403 status code, and the page title presented by the server is "Suspected phishing site | Cloudflare," confirming that the site was flagged by Cloudflare's own phishing detection mechanisms. The site employed modern transport security features, including HTTP/3 and HSTS, and presented an SSL certificate issued by Google Trust Services under the WE1 certificate authority, which is typical for Cloudflare‑proxied services.

Reputation services provide a consistent view of high risk. The domain appears on one security blocklist and is listed by PhishDestroy as a blocked phishing host. Gridinsoft assigned a trust score of 0 out of 100, while Scamadviser reported a trust score of 1 out of 100, both indicating extremely low credibility. VirusTotal analysis shows that 12 of 95 scanning engines flagged the domain, reinforcing the malicious assessment. No additional nameserver information was available, and the nameserver field is recorded as not found.

Given the limited exposure window and the presence of multiple independent detections, defenders should block any outbound connections to 188.114.96.3 and add c066b573.smrta.pages.dev to local deny lists. Network monitoring should include alerts for DNS queries to this domain, and email filtering solutions should be updated to flag messages containing URLs that resolve to the same IP range.