sniper-analytics[.]icu

The domain sniper-analytics.icu was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and remains active as of the report date, July 24, 2026. Infrastructure analysis shows the domain resolves to the IP address 172.67.131.253, which resides in the United States and is advertised as part of ASN 13335 operated by Cloudflare, Inc. Both authoritative nameservers are Cloudflare—henry.ns.cloudflare.com and stephane.ns.cloudflare.com—indicating the use of Cloudflare’s DNS and edge services. The site presents an HTTP status code of 200, yet the page title returned is "sniper-analytics.icu | 522: Connection timed out," suggesting that while the host responds, the underlying application may be intentionally throttling or misdirecting traffic.

TLS metadata reveals a certificate issued by Google Trust Services under the WE1 label, confirming the presence of a valid HTTPS layer. Automated detection pipelines have flagged the domain on two security blocklists and it is explicitly blocked by PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal scanned the host and 2 of 93 security vendors reported it as malicious, providing independent corroboration of the threat.

Technology fingerprints include Cloudflare and HTTP/3, consistent with the observed edge infrastructure. No additional malicious payloads, landing page content, or brand impersonation details have been disclosed, leaving the exact phishing lure unknown. Defenders should treat the domain as high‑risk, block the resolved IP and associated CIDR ranges, enforce DNS sinkholing on the identified nameservers, and monitor outbound connections for HTTP/3 traffic to Cloudflare‑backed endpoints. Continuous re‑evaluation is advised as threat intelligence may surface new indicators of compromise.