smtp-1[.]coolhair[.]com[.]cn

Analysis of smtp-1.coolhair.com.cn indicates the domain was registered on 2026-02-21 through 广东时代互联科技有限公司. The authoritative nameservers ns1.nowcndns.com and ns2.nowcndns.com resolve the name to 172.86.90.240, an address owned by AS14956 RouterHosting LLC in the United States. No TLS certificate is presented, and an HTTP request returns the default Apache2 Ubuntu page with the title “Apache2 Ubuntu Default Page: It works”, suggesting a misconfigured web server rather than a crafted phishing landing page. Gridinsoft assigns a trust score of 0/100, and the domain appears on a single security blocklist.

VirusTotal reports 15 of 93 scanners flagging the domain, and PhishDestroy has listed it as blocked. The threat type is recorded as generic phishing, and the current operational status is offline. Confidence in the phishing intent derives from the classification by multiple vendors and the blocklisting actions, but the lack of a visible malicious payload or credential‑collection page limits direct attribution of a specific campaign. Defenders should continue to block the domain and its resolved IP at perimeter firewalls and DNS filtering solutions.

Ongoing monitoring of the registrar and the nowcndns.com name‑server infrastructure is advisable, as changes could reactivate the host. Adding the IP to threat‑intel feeds and ensuring email security gateways reference the latest blocklist entries will reduce exposure. Given the recent creation date and the low trust score, the domain should be treated as high‑priority for proactive mitigation despite its offline state.