mail[.]snortertokens[.]world

mail.snortertokens.world is currently active and resolves to the IP address 188.114.96.3, which is hosted by Cloudflare, Inc. in Canada. The domain was registered on 21 February 2026 through OwnRegistrar, Inc. and is served behind Cloudflare’s edge network, employing HTTP/3. DNS resolution uses the nameservers jim.ns.cloudflare.com and magnolia.ns.cloudflare.com. An HTTP request to the site returns a 403 status code and the page title is reported as “Just a moment…”. The limited response suggests the site is protected by Cloudflare’s challenge page rather than delivering visible malicious content. Intelligence classifies the domain as a crypto‑related phishing operation; two of ninety‑three VirusTotal scanners have flagged it, and the Gridinsoft trust score is 0 / 100. The domain appears on one external blocklist and has been blocked by the PhishDestroy sinkhole. While the exact phishing payload or credential‑stealing page has not been observed, the combination of a recent registration, Cloudflare‑only infrastructure, low trust score, and existing detections indicates a high‑risk profile. Defenders should block network connections to 188.114.96.3, add the domain to URL filtering rules, and monitor DNS queries for the domain and its associated nameservers. Continuous scanning of the site for content changes is recommended, as the current 403 response may be a temporary barrier before malicious pages are revealed.