www-simmonsbank[.]top

This domain, www-simmonsbank.top, was identified as a high-risk credential phishing site impersonating Simmons Bank. The domain was created on February 21, 2026, and was reported as taken offline by July 23, 2026. The page title observed was 'Login', consistent with a credential harvesting page. Threat intelligence sources indicate strong evidence of malicious activity: 21 out of 93 security vendors on VirusTotal flagged the domain as malicious.

It appeared on four security blocklists: PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX included the domain in one threat intelligence pulse. The domain resolved to IP address 144.31.244.50, located in Germany, and hosted by AS213877 U1 DIGITAL SERVICES LTD. The SSL certificate used was type R13.

At the time of analysis, the domain was confirmed offline, meaning the phishing site is no longer accessible. Defenders should verify that any users who may have accessed this domain have not submitted credentials, and monitor for any related subdomains or variations. The exact content of the login page was not analyzed, but the page title and scam type strongly indicate a credential theft operation targeting Simmons Bank customers. No additional brand, kit, or vendor details are available in the provided intelligence.