smartorder[.]ai

smartorder.ai was registered through NiceNIC International Group Co., Limited on February 21 2026. The domain resolves to IP 47.84.40.176, which is allocated to AS45102 Alibaba (US) Technology Co., Ltd. and geolocated to Singapore. DNS resolution is served by Cloudflare nameservers margo.ns.cloudflare.com and blakely.ns.cloudflare.com. The TLS certificate presented is a DNSPod RSA DV certificate issued by DNSPod, Inc., confirming the use of a standard domain‑validated certificate. HTTP requests receive a 301 redirect response, and the page title returned is "Powerful All‑In‑One Hotel Management Software | Smart Order PMS", indicating an attempt to impersonate hotel‑management software.

Technology fingerprints include Ghost, Node.js, Bootstrap, Vue.js, Nginx, Express, and Google Analytics, consistent with a modern web stack. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal analysis shows that 3 of 91 scanned security vendors flagged the domain, reinforcing the phishing classification. The risk rating assigned is high and the operational status remains active as of the report date, July 24 2026.

Current evidence confirms the domain is being used for a generic phishing campaign, but the exact malicious payload or credential‑harvesting mechanisms have not been observed in the available data. Defenders should add the domain and its associated IP address to local block lists, monitor DNS queries for the Cloudflare nameservers, and enforce TLS inspection to detect any credential submission. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds are recommended to capture any escalation in detection counts. Organizations using hotel‑management or booking software should be alerted to the presence of this fraudulent site and instructed to verify URLs before entering credentials.