smtp[.]coolhair[.]com[.]cn

This domain, smtp.coolhair.com.cn, was registered on 21 February 2026 by Guangdong Shidai Huliang Technology Co., Ltd. The authoritative nameservers are ns1.nowcndns.com and ns2.nowcndns.com, and the domain resolves to the IPv4 address 172.86.90.240, which is hosted in the United States under AS14956 RouterHosting LLC. No TLS certificate is presented for the host, indicating that communications are unencrypted over HTTP. An HTTP request returns the default Apache2 Ubuntu page titled "Apache2 Ubuntu Default Page: It works," suggesting that the web server is a generic Ubuntu installation rather than a purpose‑built phishing landing page. VirusTotal records 15 detections out of 93 scanned scanners, confirming that multiple security products flag the domain as malicious.

The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk. As of the report date, 23 July 2026, the domain is listed as offline.

The available evidence confirms the presence of malicious infrastructure but provides limited insight into the specific phishing campaign or targeted victims. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual connections to the associated IP address, and consider adding the host to internal blocklists. Ongoing observation of the hosting provider and name‑server changes is recommended, as future re‑use of the same infrastructure may occur.