snekx[.]net

This domain, snekx.net, is identified as a cryptocurrency phishing site specifically targeting users of the Cardano blockchain. Analysis indicates it impersonates the SNEK meme coin project, a known decentralized asset on the Cardano network, to deceive victims into disclosing wallet credentials or transferring funds to attacker-controlled addresses. The domain is currently offline, but prior activity and infrastructure remain relevant for threat intelligence purposes. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.136.92, a Cloudflare-hosted endpoint leveraging HTTP/3 and Cloudflare Browser Insights for performance and evasion. The domain holds a Gridinsoft trust score of 0/100 and is flagged by 5 of 95 security vendors on VirusTotal. It appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy while masking malicious intent. Current status indicates the domain has been taken offline, likely in response to detection or enforcement actions. However, the underlying threat remains active, as phishing campaigns often migrate to new domains or infrastructure. Organizations and users are advised to block the domain and associated IP at perimeter security controls. Cryptocurrency wallet providers should flag any transactions referencing snekx.net or its branding. Security teams should monitor for newly registered domains using similar naming conventions or impersonating Cardano-based projects, particularly those with recent creation dates or low trust scores. End users should verify project authenticity through official channels and avoid interacting with unsolicited investment opportunities.