app[.]xn--smer-qra[.]money

The domain app.xn--smer-qra.money was registered through Dynadot LLC on February 21, 2026 and is currently taken offline. It resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site was served over HTTPS using a Let’s Encrypt certificate (issuer E8) and employed HTTP/3, indicating modern transport protocols. DNS resolution is handled by felipe.ns.cloudflare.com and harleigh.ns.cloudflare.com, confirming Cloudflare as the authoritative name service.

An HTTP GET request returned a 200 status code and the page title was observed as "sumer," but no further page content has been disclosed. Security analysis shows a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist where it has been flagged by PhishDestroy. VirusTotal analysis recorded 2 detections out of 93 scanning engines, suggesting that at least a few vendors identified malicious characteristics.

The combination of a recent registration date, Cloudflare front‑ending, low trust score, presence on a phishing blocklist, and limited VirusTotal detections aligns with typical infrastructure used for credential harvesting campaigns. Defenders should proactively block the domain and its associated IP address at network and DNS layers, monitor for any resurgence of the domain or similar punycode variations, and enforce email filtering rules that detect links to newly created, low‑reputation domains. Continuous threat‑intel feeds should be consulted for updates, and any observed traffic to the IP should be investigated for possible abuse patterns.