# PhishDestroy domain threat record: smrsflow.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/smrsflow.cc/
Machine-readable companion: https://phishdestroy.io/domain/smrsflow.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 16:39:13 UTC
- Last availability or vendor check: 2026-10-28 00:30:49 UTC
- Stored record updated: 2026-10-28 00:30:49 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: bybit

## Stored infrastructure

- Observed IP address: 172.67.159.32
- Registrar in stored WHOIS data: NameSilo, LLC
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-25 01:20:52 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17e46-7243-759e-8115-db940cb1e5ae/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/smrsflow.cc
- Certificate Transparency search: https://crt.sh/?q=%25.smrsflow.cc
- Web Archive lookup: https://web.archive.org/web/*/https://smrsflow.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed smrsflow.cc as a suspicious domain based on an admin report submitted on 2026-10-27. The site presented a page titled "Exchange" and returned HTTP 200 on the same day. The prior automated assessment noted insufficient page content to determine a specific threat.

How the scam works
The current evidence does not demonstrate a concrete scam mechanism; the listing only indicates that the domain may be used for deceptive purposes such as phishing or fake exchange offers. Without observed malicious behavior, the risk remains speculative and should be treated as a potential threat.

Evidence
VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported 0 malicious or suspicious detections. Google Safe Browsing checked on 2026-10-27 and did not flag the site. urlscan.io captured the page on 2026-10-26, assigning a machine‑learning score of 85 with a malicious tag, though its overall verdict was non‑malicious. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal blocklist marked it as true; OTX recorded no pulses as of 2026-10-27.

Infrastructure
The domain was registered on 2026-10-25 through NameSilo, LLC and is hosted behind Cloudflare, resolving to IP 104.21.9.56 in Canada. TLS was provided by Let’s Encrypt, valid until 2027-01-23, and the site served an HSTS header with a one‑year max‑age. DNS records show A and AAAA entries without DNSSEC signatures.

What to do
Visitors should avoid entering any credentials, wallet addresses, or personal information on the site and consider changing passwords if any were submitted. Monitor associated accounts for unexpected activity and report suspicious behavior to relevant platforms. Defenders can block traffic to smrsflow.cc at the network perimeter and review logs for any access attempts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a179df-670f-73b7-a68e-ed05319f2988/
Cloudflare Radar report: https://radar.cloudflare.com/scan/32a61488-1af3-4f76-b11c-6906307cc0b3
Stored capture screenshot: https://urlscan.io/screenshots/01a179df-670f-73b7-a68e-ed05319f2988.png
Cloudflare Radar screenshot (2026-10-27T16:42:17Z): https://screenshots.phishdestroy.io/cf/32a61488-1af3-4f76-b11c-6906307cc0b3.png
VirusTotal report: https://www.virustotal.com/gui/domain/smrsflow.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=smrsflow.cc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 16:46:10 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/LbfY9Ry/310e477a4bd9.png
  Captured: 2026-10-27 16:53:36 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a17e46-7243-759e-8115-db940cb1e5ae.png
  Captured: 2026-10-27 16:53:36 UTC
  Source report: https://urlscan.io/result/01a17e46-7243-759e-8115-db940cb1e5ae/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a179df-670f-73b7-a68e-ed05319f2988.png
  Captured: 2026-10-27 16:39:13 UTC
  Source report: https://urlscan.io/result/01a17e46-7243-759e-8115-db940cb1e5ae/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/32a61488-1af3-4f76-b11c-6906307cc0b3.png
  Captured: 2026-10-27 16:42:17 UTC
  Source report: https://radar.cloudflare.com/scan/32a61488-1af3-4f76-b11c-6906307cc0b3
  SHA-256: d40e1c358b7b517b047105e52ad90cc9042f06916691b03e82eeec0fb3104648

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T17:12:41Z",
        "uuid": "01a17e46-7243-759e-8115-db940cb1e5ae",
        "scanned_at": "2026-10-27T16:51:55Z",
        "final_url": "https://smrsflow.cc/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://smrsflow.cc/",
                "from": "http://smrsflow.cc/",
                "status": 307
            }
        ],
        "ip": "172.67.159.32",
        "domains": [
            "ysviposs.oss-us-west-1.aliyuncs.com",
            "qtapi.exchprono.work"
        ],
        "ips": [
            "47.254.114.122",
            "52.128.248.34",
            "172.67.159.32"
        ],
        "asns": [
            "45102",
            "45753",
            "13335"
        ],
        "countries": [
            "US",
            "HK"
        ],
        "doc_hash": "44e4da3a4071de51fdd20b00bb8340e50e107574c5e2111dd6636d8fbbfb19a1",
        "script_hashes": [
            "bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb",
            "67d175991be6e491770d67721b4f62b9ab260b980920e6976b353c8b9a063aa6",
            "2d5eefab935086fc18a64af61b3afbdfd7279e3bc315c4486a39227b266be219",
            "96a3c479e0b63a58389e0977f49ba75e6b92fad560492a0eb66bd38f21322940",
            "0b704c38cf46ef30459a7276e822bc6822922041c2fa7d7de4b555554797d97f",
            "4f125274c4e2222809bd5c722e91a7d64ddd61b3c1cb792e11df963911811882",
            "8ac85f418278416ff35660c5fa77b4efd58a4fdb132e172dfe59173461de8c75",
            "07e1e1f861b21bd865d3d6de44dff1940a4bf55b6d45abf3b98cec5b71ff2343",
            "7ca2f1d09f3f1f1de480bc224d0ba7ab5e33f2638d6fa778511fb70ec0bbd157",
            "6795c3aaa4ebd86ad0e555ff86134170aa8ebe966110cd0f34b7eeea60e6cd21"
        ],
        "globals": [
            "addLink",
            "addMeta",
            "TradingView",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser"
        ],
        "cookies": [
            "server_session_4b332a1a"
        ],
        "storage_keys": [
            "dev_THEME",
            "main",
            "dev_LANGUAGE"
        ],
        "tls": {
            "san": [
                "*.smrsflow.cc",
                "smrsflow.cc"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "smrsflow.cc",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T01:32:55Z",
            "valid_from": "2026-10-25T01:32:56Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 82,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "bybit"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Bybit"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T16:45:37Z",
        "uuid": "32a61488-1af3-4f76-b11c-6906307cc0b3",
        "scanned_at": "2026-10-27T16:42:17Z",
        "final_url": "https://smrsflow.cc/",
        "status": 200,
        "history": [
            {
                "url": "https://smrsflow.cc/",
                "status": 200
            }
        ],
        "dom_hash": "f6eecc01295f2b0d8a009d1f22b9ee9206a4eb424f0663c06668e4c383725a2c",
        "doc_hash": "3e6995ab7882864eb9e8e822b8feadde18a52fa0fb5e2080d398fa7b20d0443f",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "smrsflow.cc",
                "type": "A",
                "value": "172.67.159.32"
            },
            {
                "name": "smrsflow.cc",
                "type": "A",
                "value": "104.21.9.56"
            },
            {
                "name": "smrsflow.cc",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:938"
            },
            {
                "name": "smrsflow.cc",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:9f20"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.26",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-25T02:20:52Z",
            "updated": "2026-10-25T02:28:08Z",
            "expires": "2027-10-25T02:20:52Z",
            "nameservers": [
                "romina.ns.cloudflare.com",
                "stanley.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T16:40:49Z",
        "analysis_at": "2026-10-25T06:57:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NameSilo, LLC",
        "created": "2026-10-25T02:20:52Z",
        "expires": "2027-10-25T02:20:52Z",
        "updated": "2026-10-25T02:28:08Z",
        "first_seen": "2026-10-25T02:34:41Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "romina.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:938"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "stanley.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:9f20"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.9.56"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "romina.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.159.32"
            }
        ],
        "dns_at": "2026-10-25T07:10:43Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.smrsflow.cc",
                "smrsflow.cc"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "66df9e070b5aea3207e3419ddd80601424a",
            "sha256": "da9dcad231f35318115bbe5c495e2b399ead8ccae10927d0080324a1632d79de",
            "subject": "smrsflow.cc",
            "valid_to": "2027-01-23T01:32:55Z",
            "valid_from": "2026-10-25T01:32:56Z"
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "http://www.namesilo.com",
            "created": "2026-10-25T02:20:52Z",
            "updated": "2026-10-25T02:28:08Z",
            "expires": "2027-10-25T02:20:52Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "romina.ns.cloudflare.com",
                "stanley.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-25T02:20:52Z",
                "last changed": "2026-10-25T02:28:08Z",
                "registration": "2026-10-25T02:20:52Z",
                "last update of RDAP database": "2026-10-25T02:34:10Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T16:45:59Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "smrsflow.cc"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-27T16:41:15Z",
            "first": "2026-10-27T16:41:15Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 3231
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Exchange",
            "robots": "all",
            "ogImage": "/platform/dev/logo_144.png?2.0.1773217373072",
            "ogTitle": "Exchange",
            "keywords": "Exchange",
            "themeColor": "#ffffff",
            "description": "Exchange",
            "ogDescription": "Exchange"
        },
        "trackers": {
            "requests": 25
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 31,
                "wait": 576,
                "connect": 7,
                "download": 0
            },
            "response_ms": 616
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 5325,
            "co2_grams": 0.0002,
            "cleaner_than": 85
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.141",
                    "host": "stanley.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.159",
                    "host": "romina.ns.cloudflare.com"
                }
            ],
            "zone": "smrsflow.cc"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "server_session_4b332a1a",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3035::6815:938",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "smrsflow.cc"
        },
        "dns": {
            "A": [
                "172.67.159.32",
                "104.21.9.56"
            ],
            "NS": [
                "stanley.ns.cloudflare.com",
                "romina.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"romina.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418513347, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3037::ac43:9f20",
                "2606:4700:3035::6815:938"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3037::ac43:9f20",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://smrsflow.cc"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Vue.js",
                "PubSubJS",
                "HSTS",
                "Cloudflare",
                "Vite",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-25T02:20:52Z",
            "updated": "2026-10-25T02:28:08Z",
            "expires": "2027-10-25T02:20:52Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "romina.ns.cloudflare.com",
                "stanley.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```