smartpocke[.]app

PhishDestroy has identified smartpocke.app as an elevated-risk threat, specifically a credential theft phishing site designed to trick users into revealing login credentials and personal information. The domain was found to be impersonating legitimate services, likely aiming to harvest sensitive data from unsuspecting victims. Its recent creation and rapid flagging by security vendors highlight the urgency of this threat.

Technical analysis reveals multiple red flags: VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious. The site is hosted on IP 188.114.96.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with suspicious domains. Created on March 26, 2026, it is a very young domain—a common trait for phishing operations. It appears on one security blocklist and is found in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Google Trust Services (WE1), which may lend a false sense of legitimacy, but the page title "Just a moment..." is typical of Cloudflare challenge pages used to obscure malicious activity. The site is currently offline, but similar domains may still be active.

To protect against credential theft phishing, users should never enter passwords or personal data on sites they landed on via unsolicited links or emails. Always verify URLs carefully; smartpocke.app is not a legitimate service. Enable multi-factor authentication on all accounts to add an extra layer of security. If you have already submitted credentials to this domain, change those passwords immediately and monitor accounts for suspicious activity. Report any encounter with this domain to relevant security teams or platforms.