sniper-coin[.]fun

sniper-coin.fun was registered on April 15, 2026 through Global Domain Group LLC. The domain uses the Cloudflare nameservers carol.ns.cloudflare.com and venkat.ns.cloudflare.com and presents a valid Let's Encrypt certificate (issuer E8). The registration date places the domain in the current threat landscape and the use of a reputable registrar and CDN suggests an attempt to blend with legitimate traffic.

Infrastructure analysis shows the domain resolves to IP 104.21.6.18, a Cloudflare edge node located in Canada. HTTP requests to the host return a 403 status, indicating that a web server is present but access is restricted. The IP appears on a single security blocklist and the domain is listed by PhishDestroy as still active. AlienVault OTX includes the domain in one pulse, and VirusTotal records four positive detections out of ninety‑five scanners, while Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment.

Threat intelligence classifies sniper-coin.fun as a generic_phishing instrument, most likely employed for credential harvesting. The presence of a valid TLS certificate and a 403 response are common tactics to evade automated crawlers while presenting a plausible login portal to unsuspecting users. No malicious payloads have been publicly released, so the exact lure (e.g., cryptocurrency wallet, investment offer) remains uncertain, but the pattern aligns with recent financial‑themed phishing campaigns.

Defenders should block DNS resolution for sniper-coin.fun and the associated IP 104.21.6.18 at the perimeter and on endpoint security solutions. Email filtering rules that detect URLs pointing to the domain should be enabled, and any observed 403 redirects should be examined for hidden credential‑capture pages. Continuous monitoring of Cloudflare edge IPs and regular re‑query of threat feeds will help capture any pivot to new infrastructure.