snapshot-bruv[.]co

Analysis of snapshot-bruv.co, created on February 21, 2026, shows that the domain resolves to the IP address 172.67.216.21, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented an SSL certificate identified as WE1, indicating the use of a valid TLS layer despite the malicious purpose. The page title returned by the server is "BRUV Snapshot," but no further content analysis is available because the site was taken offline before a detailed crawl could be performed.

VirusTotal records indicate that the domain was examined by 93 scanning vendors, none of which raised a detection at the time of the scan; this absence of alerts does not constitute a safety guarantee. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. Infrastructure observations suggest that the attacker leveraged Cloudflare’s CDN to mask the true origin of the payload, a common tactic in phishing campaigns to evade attribution.

Given the combination of a recent registration, the use of a reputable TLS certificate, and the presence on a dedicated phishing blocklist, defenders should add snapshot-bruv.co to deny‑list rules, monitor DNS queries for the associated IP, and ensure that any residual traffic is diverted to a sinkhole. Ongoing vigilance is advised because the offline status may be temporary, and the underlying infrastructure could be repurposed for future campaigns.