mail-smythpl[.]energyasteels[.]com

The domain mail-smythpl.energyasteels.com was registered through Realtime Register B.V. on 21 February 2026. DNS resolution points to the Cloudflare‑owned address 188.114.96.3, which belongs to ASN 13335 and is geolocated in the United States. The domain does not present an SSL/TLS certificate, indicating that any HTTPS connections would be unencrypted or that the site is not currently serving content over TLS. HTTP probing shows the site is taken offline, and the page title returned when the service was reachable was “Welcome to XAMPP”, a generic XAMPP landing page that offers no direct evidence of credential‑collection functionality.

The infrastructure is further characterized by the use of Cloudflare nameservers lars.ns.cloudflare.com and ullis.ns.cloudflare.com, a common pattern for fast‑flux or proxy‑based phishing infrastructure. Security telemetry flags the domain as a brand‑impersonation campaign targeting Facebook. Twelve of ninety‑five VirusTotal scanners reported malicious indicators, and the site appears on a single external blocklist. PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is recorded as 0 out of 100, reinforcing the classification as malicious.

No legitimate SSL certificate, the low trust score, and the presence of a generic XAMPP title collectively suggest that the site was likely used to host a phishing landing page or similar credential‑harvesting mechanism before being taken down. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address 188.114.96.3 for any resurgence of malicious activity, and add the domain to internal threat‑intel feeds. Given the recent registration date and the observed use of Cloudflare infrastructure, similar domains may be generated in the near future; proactive domain‑generation algorithms and brand‑specific detection rules are recommended to mitigate repeat attempts.