graphql-m2[.]snowdog[.]dev

PhishDestroy identifies graphql-m2.snowdog.dev as an active phishing domain engineered to mimic a legitimate GraphQL interface, primarily targeting developers and technical users with sophisticated spoofing tactics. This domain resolves to the IP address 104.21.21.152 and is currently protected by a Google Trust Services SSL certificate, which lends false legitimacy to its fraudulent pages. The domain was flagged with a unique seed identifier 07b1f4 and remains under investigation for active phishing operations.

This domain exhibits clear indicators of compromise: VirusTotal currently reports 1 out of 95 antivirus engines detecting the threat, highlighting the evasive nature of the campaign. The domain leverages a deceptive naming convention to appear connected to the legitimate service snowdog.dev, potentially exploiting user trust in well-known developer tools. The infrastructure maps to Cloudflare IP ranges, commonly abused for phishing operations due to their global distribution and caching capabilities.

Users who may have visited graphql-m2.snowdog.dev should immediately review browser history and disable any active sessions on developer platforms or email accounts accessed from that session. Change passwords immediately, especially for accounts linked to development tools or API access. Enable multi-factor authentication wherever possible, and report the domain to your IT security team or via PhishDestroy’s submission portal. Consider using a reputable DNS filtering service to block future access to this malicious domain.