fastsmsverify[.]com[.]ng

On July 19 2026 the domain fastsmsverify.com.ng was observed hosting a credential phishing campaign. The site presents the title “fastsmsverify - SMS Verification Service”, suggesting a service that could be abused to harvest SMS‑based verification codes. The domain resolves to the IPv4 address 163.61.188.7, which is geolocated to the United States and is associated with a MIT‑affiliated network. The server presents a Let’s Encrypt certificate issued under the YR1 program, indicating recent TLS deployment. Infrastructure is hosted on TRUEHOST CLOUD and uses four LyteHosting name servers (dns1‑dns4.lytehosting.com). MX records point to the same domain, a pattern often used to receive victim communications. The domain is listed on one public blocklist and is actively blocked by the PhishDestroy sinkhole. AlienVault OTX has indexed the domain in two separate threat‑intel pulses, and VirusTotal reports five detections out of ninety‑one scanners. While the page content has not been publicly dissected, the combination of a credential‑phishing classification, active status, high risk rating, and existing detections indicates a live threat. Defenders should add fastsmsverify.com.ng to URL filtering and DNS block lists, monitor outbound traffic for connections to 163.61.188.7, and consider isolating any internal accounts that rely on SMS‑based verification until the campaign is mitigated.