# PhishDestroy domain threat record: snapplusgratuit.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/snapplusgratuit.net/ Machine-readable companion: https://phishdestroy.io/domain/snapplusgratuit.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 16:37:58 UTC - Last availability or vendor check: 2026-10-22 23:04:49 UTC - Stored record updated: 2026-10-22 23:04:49 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: snapchat ## Stored infrastructure - Observed IP address: 193.108.130.12 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date (registry RDAP, snapplusgratuit.net): 2026-07-16 09:44:35 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a15f57-587c-77b8-a8ac-abfad9697d04/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/snapplusgratuit.net - Certificate Transparency search: https://crt.sh/?q=%25.snapplusgratuit.net - Web Archive lookup: https://web.archive.org/web/*/https://snapplusgratuit.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified snapplusgratuit.net as malicious, citing a high confidence that the page impersonates Snapchat to promise a free Snapchat+ subscription. The recorded page title advertises “Snap Plus Gratuit 2026” and claims to activate the premium service. The domain was first seen by PhishDestroy on 2026-10-21, when an HTTP 200 response was recorded. How the scam works Scammers create pages that mimic a brand’s look and promise a free version of a paid service. They typically ask visitors for their account username or email and may present a CAPTCHA to keep the user engaged while harvesting credentials. Collected usernames can be reused for credential‑stuffing attacks or sold to other actors. Evidence VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing also returned no flag on that date. urlscan.io captured the site on 2026-10-21 and issued a malicious verdict with a score of 100, tagging it as phishing and linking it to the Snapchat brand. OTX listed four pulses mentioning the domain as of 2026-10-21, and PhishDestroy’s internal blocklist includes the domain while external blocklists showed no entries. Infrastructure The domain was registered on 2026-07-16 through NICENIC INTERNATIONAL GROUP CO., LIMITED, giving it an age of 97 days at first observation. The recorded IP address was 193.108.130.12, which belonged to Webhosting Holdings LLC and was located in the Netherlands. TLS was provided by a Let’s Encrypt certificate issued on 2026-10-03 and valid until 2027-01-01, covering multiple SANs unrelated to the brand. What to do Anyone who may have entered Snapchat credentials should change the password and enable two‑factor authentication. Organizations should add snapplusgratuit.net to blocklists and monitor DNS logs for queries to the domain. Threat‑intel teams can reference the urlscan.io malicious verdict and PhishDestroy internal listing when updating their feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15f57-587c-77b8-a8ac-abfad9697d04/ Cloudflare Radar report: https://radar.cloudflare.com/scan/73be73c0-9726-440d-9360-1c913e2c0b35 Stored capture screenshot: https://i.ibb.co/HLqpzGg6/ef5771bdd10f.png Cloudflare Radar screenshot (2026-10-21T16:38:37Z): https://screenshots.phishdestroy.io/cf/73be73c0-9726-440d-9360-1c913e2c0b35.png VirusTotal report: https://www.virustotal.com/gui/domain/snapplusgratuit.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=snapplusgratuit.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 17:39:25 UTC ## Stored page captures - Primary capture: https://i.ibb.co/HLqpzGg6/ef5771bdd10f.png Captured: 2026-10-21 16:42:48 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a15f57-587c-77b8-a8ac-abfad9697d04.png Captured: 2026-10-21 16:42:48 UTC Source report: https://urlscan.io/result/01a15f57-587c-77b8-a8ac-abfad9697d04/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a05d4b-4c5c-73a9-a308-ac4c10aed25a.png Captured: 2026-10-21 16:37:58 UTC Source report: https://urlscan.io/result/01a15f57-587c-77b8-a8ac-abfad9697d04/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/73be73c0-9726-440d-9360-1c913e2c0b35.png Captured: 2026-10-21 16:38:37 UTC Source report: https://radar.cloudflare.com/scan/73be73c0-9726-440d-9360-1c913e2c0b35 SHA-256: 2f237c5d3d04c107ae4f2e86bc57e330de4b66808723795b19fb40e34cf4177e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T17:09:45Z", "uuid": "01a15f57-587c-77b8-a8ac-abfad9697d04", "scanned_at": "2026-10-21T16:42:10Z", "final_url": "https://snapplusgratuit.net/", "status": 200, "ip": "193.108.130.12", "ptr": "lu-shared02.cpanelplatform.com", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.16.94", "172.253.63.95", "193.108.130.12" ], "asns": [ "15169", "965" ], "countries": [ "US" ], "link_domains": [ "appsave.online" ], "doc_hash": "c64f1c9f4de3bc0ecc3f00f1883f230c1bf7c4b94aba8205776dddec5940965f", "script_hashes": [ "38769b0dd475bdac03a8cfc08aef38b3402bcd1eb7fcb6bcc6a0fb588920f485" ], "globals": [ "setStep", "setRingProgress", "validateUsername", "showError", "formatSubscribers", "lookupSnapchatProfile", "buildFallbackProfile", "getLookupErrorMessage", "renderProfileCard", "hideProfileCard", "sleep", "buildTaskList", "updateTask", "setupLockerButton", "openModal", "closeModal", "closeAllModals", "resetTikTokModalScroll", "initTikTokGuideTabs", "initTikTokGuideScroll", "formatAgeFrench", "getTikTokVerifyErrorMessage", "setTikTokVerifyStatus", "verifyTikTokVideoUrl", "openTikTokModal", "openTikTokConfirmModal", "closeTikTokConfirmModal", "runActivation", "makeActivationId", "animateLiveUsers", "RING_CIRCUMFERENCE", "LOCKER_URL", "state", "steps", "stepsBarFill", "stepsLabel", "usernameForm", "usernameInput", "usernameError", "loaderRing" ], "tls": { "san": [ "*.com.pechosnapplus.com", "*.debansnap.com", "*.pechosnapplus.com", "*.snapplus.live", "*.snapplusgratuit.net", "debansnap.com", "pechosnapplus.com", "snapplus.live", "snapplus.live.pechosnapplus.com", "snapplusgratuit.net" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "www.snapplusgratuit.net.pechosnapplus.com", "protocol": "TLS 1.3", "valid_to": "2027-01-01T04:23:45Z", "valid_from": "2026-10-03T04:23:46Z" }, "domain_age_days": 97, "apex_age_days": 97, "tls_age_days": 18, "tls_valid_days": 89, "requests": 7, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "snapchat" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Snapchat" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "LiteSpeed", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T16:38:54Z", "uuid": "73be73c0-9726-440d-9360-1c913e2c0b35", "scanned_at": "2026-10-21T16:38:37Z", "final_url": "https://snapplusgratuit.net/", "status": 200, "history": [ { "url": "https://snapplusgratuit.net/", "status": 200 } ], "dom_hash": "59b2af97b89b029dfb479b5128be8666155f0bab6f0fbb31ea5590c02493d42a", "doc_hash": "c64f1c9f4de3bc0ecc3f00f1883f230c1bf7c4b94aba8205776dddec5940965f", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "snapplusgratuit.net", "type": "A", "value": "193.108.130.12" }, { "name": "snapplusgratuit.net", "type": "AAAA", "value": "2602:faa9:3005:723:78cc:aeb8:1a38:3afa" } ], "dnssec_valid": false, "ip": "193.108.130.12", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-07-16T09:44:35Z", "updated": "2026-09-04T10:00:59Z", "expires": "2027-07-16T09:44:35Z", "nameservers": [ "ns1.private-nameserver.net", "ns2.private-nameserver.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T17:39:02Z", "analysis_at": "2026-10-21T17:02:25Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-07-16T09:44:36Z", "expires": "2027-07-16T09:44:35Z", "updated": "2026-09-04T10:00:59Z", "first_seen": "2026-07-16T14:10:48Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "snapplusgratuit.net", "priority": 0 }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:193.108.130.12 include:spf.mxyeet.net ~all" }, { "ttl": 14400, "type": "A", "value": "193.108.130.12" }, { "ttl": 21600, "type": "SOA", "rname": "admin.namecrane.net", "value": "ns1.private-nameserver.net" }, { "ttl": 21600, "type": "NS", "value": "ns4.private-nameserver.net" }, { "ttl": 21600, "type": "NS", "value": "ns1.private-nameserver.net" }, { "ttl": 21600, "type": "NS", "value": "ns3.private-nameserver.net" }, { "ttl": 14400, "type": "AAAA", "value": "2602:faa9:3005:723:78cc:aeb8:1a38:3afa" }, { "ttl": 21600, "type": "NS", "value": "ns2.private-nameserver.net" } ], "dns_at": "2026-10-21T17:07:49Z", "jarm": "21d19d00021d21d00042d43d00000091f9827a8676a9d9f27d421962a09b5d", "cert": { "san": [ "*.com.pechosnapplus.com", "*.debansnap.com", "*.pechosnapplus.com", "*.snapplus.live", "*.snapplusgratuit.net", "debansnap.com", "pechosnapplus.com", "snapplus.live", "snapplus.live.pechosnapplus.com", "snapplusgratuit.net" ], "issuer": "Let's Encrypt / YR1", "serial": "6f9e9c8c6485131c190ed1e80c6a5a87682", "sha256": "7e605f79a2743fe4c606cb6c13bbdd029bbbea66f59be19dd19f049bb9a23e64", "subject": "www.snapplusgratuit.net.pechosnapplus.com", "valid_to": "2027-01-01T04:23:45Z", "valid_from": "2026-10-03T04:23:46Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-07-16T09:44:35Z", "updated": "2026-07-16T09:44:36Z", "expires": "2027-07-16T09:44:35Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns1.private-nameserver.net", "ns2.private-nameserver.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-07-16T09:44:35Z", "registration": "2026-07-16T09:44:36Z", "registrar expiration": "2027-07-16T09:44:35Z", "last update of RDAP database": "2026-07-16T09:44:36Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T16:39:07Z", "mail_config": { "mx": [ "snapplusgratuit.net" ], "spf": "v=spf1 +a +mx +ip4:193.108.130.12 include:spf.mxyeet.net ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 3 }, "caa_records": { "domain": "snapplusgratuit.net" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://snapplusgratuit.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "ogUrl": "https://snapplusgratuit.net/", "title": "Snap Plus Gratuit 2026 | Snapchat+ Gratuit — snapplusgratuit.net", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "ogImage": "https://snapplusgratuit.net/og-image.jpg", "ogTitle": "Snap Plus Gratuit 2026 | Snapchat+ Gratuit — snapplusgratuit.net", "keywords": "snap plus gratuit, snapchat+ gratuit, snapchat plus gratuit, snap+, snapplusgratuit.net, abonnement snap plus gratuit", "ogSiteName": "snapplusgratuit.net", "themeColor": "#FFFC00", "description": "Snapchat+ gratuit sur snapplusgratuit.net : active Snapchat Plus gratuitement en quelques minutes. Vérification rapide et méthode alternative TikTok. Offre 2026.", "twitterCard": "summary_large_image", "canonicalUrl": "https://snapplusgratuit.net/", "ogDescription": "Snapchat+ gratuit sur snapplusgratuit.net : activation rapide, vérification simple et méthode alternative TikTok." }, "trackers": { "requests": 6, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 20, "wait": 19, "connect": 18, "download": 13 }, "response_ms": 71 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 23199, "co2_grams": 0.0008, "cleaner_than": 54 }, "dns_server": { "ns": [ { "ip": "199.195.255.66", "host": "ns2.private-nameserver.net" }, { "ip": "205.185.112.66", "host": "ns1.private-nameserver.net" }, { "ip": "199.195.255.66", "host": "ns3.private-nameserver.net" }, { "ip": "209.141.39.8", "host": "ns4.private-nameserver.net" } ], "zone": "snapplusgratuit.net" }, "location": { "ip": "2602:faa9:3005:723:78cc:aeb8:1a38:3afa", "asn": "965", "org": "Webhosting Holdings LLC", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "www.snapplusgratuit.net.pechosnapplus.com" }, "dns": { "A": [ "193.108.130.12" ], "MX": [ "{\"exchange\": \"snapplusgratuit.net\", \"priority\": 0}" ], "NS": [ "ns2.private-nameserver.net", "ns1.private-nameserver.net", "ns3.private-nameserver.net", "ns4.private-nameserver.net" ], "SOA": "{\"nsname\": \"ns1.private-nameserver.net\", \"hostmaster\": \"admin.namecrane.net\", \"serial\": 2026100301, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:193.108.130.12 include:spf.mxyeet.net ~all" ], "AAAA": [ "2602:faa9:3005:723:78cc:aeb8:1a38:3afa" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2602:faa9:3005:723:78cc:aeb8:1a38:3afa", "family": 6 }, "redirects": { "chain": [ "https://snapplusgratuit.net" ] }, "rank": { "domain": "snapplusgratuit.net" }, "tech_stack": { "technologies": [ "YouTube", "LiteSpeed", "Google Font API", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 2 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-07-16T09:44:35Z", "updated": "2026-09-04T10:00:59Z", "expires": "2027-07-16T09:44:35Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.private-nameserver.net", "ns2.private-nameserver.net" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html" } } } } ```