smartaffixconnect[.]com

Analysis of smartaffixconnect.com shows a high‑risk phishing infrastructure that was created on 21 February 2026 and subsequently taken offline. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by the Cloudflare authoritative name servers adaline.ns.cloudflare.com and carl.ns.cloudflare.com. Registration was performed through MAT BAO CORPORATION, indicating a potentially disposable registrar commonly used for malicious domains.

The site presents the page title “Suspected phishing site | Cloudflare” and is protected by an SSL certificate issued by Google Trust Services under the WE1 label, confirming that TLS termination is provided by Cloudflare’s edge network. Reputation checks reveal that 14 of 93 security vendors on VirusTotal flag the domain as malicious, and the site appears on five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Google Safe Browsing categorises the URL as a social‑engineering threat, and Gridinsoft assigns a trust score of 2 out of 100, reinforcing the malicious assessment. The only technology detected is Cloudflare’s CDN and security services.

While the page content beyond the title has not been captured, the convergence of registration details, hosting on a shared Cloudflare IP, multiple vendor detections, and blocklist listings provides strong evidence of a phishing operation. Defenders should immediately block the domain and its resolving IP at perimeter and DNS layers, ingest the five blocklist entries into existing threat‑intel feeds, and enforce safe‑browsing warnings for users. Continuous monitoring is advised in case the actor re‑registers the domain or shifts to a new host, and any future requests to the IP should be logged and investigated for potential credential harvesting attempts.