snapshotbox[.]click

This domain, snapshotbox.click, is flagged as an active phishing site distributing an Airdrop scam kit. Analysis indicates the domain was registered on November 23, 2025, through Dynadot LLC and currently resolves to 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site employs Cloudflare for DNS and CDN services, with nameservers including alexa.ns.cloudflare.com, ns1.dyna-ns.net, and randall.ns.cloudflare.com, alongside an SSL certificate issued by Google Trust Services. The domain returns an HTTP 301 redirect status, suggesting it may forward visitors to another malicious endpoint, though the exact destination remains unconfirmed. Security vendors have detected the domain on two blocklists (PhishDestroy and ScamSniffer), and it appears in 23 threat intelligence pulses on AlienVault OTX. While only 3 of 95 security vendors flagged the domain in scans, this does not indicate safety, as the domain remains actively malicious. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as a confirmed threat, block it at the DNS and network levels, and monitor for related infrastructure, particularly any domains using the same nameservers or IP range. The exact content of the phishing kit is not yet analysed, but the Airdrop scam classification suggests it likely targets cryptocurrency users with fraudulent token distribution schemes.