savermarts[.]com

Analysis of savermarts.com shows a newly registered domain created on August 03, 2026 that is currently resolving to the IP address 188.114.96.3. The domain is hosted on Cloudflare infrastructure, as indicated by its authoritative name servers sid.ns.cloudflare.com and val.ns.cloudflare.com. The registrar listed for the registration is NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that it is recognized as malicious by at least two independent sources.

VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation vendors, and none of those engines generated a detection; however, the absence of a detection does not constitute evidence of benign behavior and should not be interpreted as a safety signal. No public Safe Browsing, OTX, or similar reputation data were provided, and the page title, HTTP response codes, SSL certificate details, and any content‑specific indicators have not been disclosed, leaving the exact phishing payload and targeted brand undefined. The current operational status remains active, meaning the site is reachable and may be delivering phishing content.

Defenders should treat the domain as hostile: add savermarts.com to URL filtering and DNS block lists, monitor outbound traffic for connections to 188.114.96.3, and consider sinkholing the IP if feasible. Continuous re‑evaluation is advised, as future scans may reveal additional indicators or content changes. Organizations should also watch for similarly constructed domains registered through the same registrar or using the same Cloudflare name servers, as threat actors often reuse these components for rapid deployment of phishing campaigns.