claim-snoonaut[.]xyz

Analysis of the domain claim-snoonaut.xyz indicates it was a brand-impersonation phishing site targeting Discord users through a fraudulent airdrop scheme. The domain was registered on July 18, 2025, via Web Commerce Communications Ltd and resolved to the IP address 104.21.16.1, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate was issued by Cloudflare TLS Issuing ECC CA 1, a common configuration for both legitimate and malicious sites leveraging Cloudflare's services. The page title, 'Snoonaut Airdrop Claim,' suggests the site was designed to deceive users into believing they could claim a cryptocurrency or token airdrop, a tactic frequently associated with social media and Discord phishing campaigns.

While the exact content of the site remains unanalyzed, the classification as an 'Airdrop Scam' aligns with the observed page title and known phishing kit behavior. At the time of assessment, six of ninety-five security vendors on VirusTotal flagged the domain as malicious, and it appeared on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. Infrastructure analysis reveals the domain was taken offline by July 23, 2026, though historical records confirm its prior use in phishing operations.

Defenders should treat any residual links or cached references to this domain as malicious and prioritize blocking the domain and its associated IP address (104.21.16.1) in network security controls. Organizations are advised to monitor for related domains registered through the same registrar or utilizing similar naming conventions, as phishing actors often reuse infrastructure across campaigns. No evidence suggests this domain was ever legitimate, and its creation date aligns with the timeline of active phishing activity.