smrturl[.]co

Analysis of smrturl.co indicates that the domain was registered on March 06, 2026 through GANDI SAS. The authoritative nameservers are MARGOT.NS.CLOUDFLARE.COM and TRACE.NS.CLOUDFLARE.COM, indicating the use of Cloudflare’s DNS service. DNS resolution points to IP address 104.18.20.222, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, a standard certificate for Cloudflare‑proxied sites. The site title returned by HTTP requests is “Flash Rewards”.

An HTTP GET returns status code 403, suggesting that direct access to the resource is denied or that the content is hidden behind access controls. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal reports that 11 of 94 scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The combination of a recent registration date, use of reputable hosting infrastructure, a generic reward‑type page title, and multiple security detections aligns with a generic phishing operation. The current offline status indicates that the infrastructure has been taken down or is otherwise unavailable at the time of analysis.

Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms employed, as the page content was not captured. No evidence of additional infrastructure, such as command‑and‑control servers or related domains, is present in the available data. Defenders should continue to block the domain at perimeter filters and update any URL or domain reputation lists with the observed indicators. Monitoring of the associated IP address and Cloudflare AS13335 traffic for new or re‑used domains is recommended.