williamsmithinsurance[.]com

Analysis of the domain williamsmithinsurance.com indicates it was actively used for brand impersonation targeting Facebook, classified as a social media phishing threat. The domain was registered on October 14, 2024, through NameCheap, Inc., and resolved to IP address 96.125.173.182, hosted on AS19871 (Network Solutions, LLC) in the United States. Nameservers were ns1.livebcfserver.com and ns2.livebcfserver.com. As of July 23, 2026, the domain is offline, though its infrastructure remains documented in threat intelligence sources. The domain appears in 16 AlienVault OTX pulses and is listed on one security blocklist, with PhishDestroy marking it as blocked.

Gridinsoft assigned a trust score of 0/100, reflecting high confidence in malicious classification. Fourteen of 95 security vendors on VirusTotal flagged the domain, though the absence of additional context limits interpretation of detection specifics. The page title, 'Auto, Home, Life and Business Insurance Services San Antonio, TX | William Smith Insurance,' does not directly reference Facebook, but the scam type and brand target fields explicitly identify Facebook impersonation as the intended deception. Technical indicators include the use of WordPress, MySQL, PHP, Apache HTTP Server, and frontend libraries such as jQuery Migrate and Slick.

The SSL certificate was issued by Let’s Encrypt (R12). While the domain is currently offline, defenders should treat it as a confirmed malicious indicator. Network security teams are advised to block the domain, its resolved IP, and associated nameservers at perimeter controls. Historical logs should be reviewed for connections to 96.125.173.182 or requests to williamsmithinsurance.com to identify potential prior exposure.