snak[.]cz

This investigation focuses on the Internet-facing asset snak.cz, which was first registered on 29 June 2018 through the Czech registrar REG‑INTERNET‑CZ. The domain is currently delegated to the nameserver pair ns.ppc.cz (IPv4 88.86.123.228, IPv6 2a01:28:ca:107::2:500) and ns2.ppc.cz (same address set), indicating that the hosting provider operates its own DNS infrastructure. DNS resolution points to the public address 95.168.219.153, a host that appears in at least one external blocklist and has been explicitly listed by the PhishDestroy sink‑hole as malicious.

VirusTotal analysis reports that two out of ninety‑one antivirus and URL‑reputation engines have raised a detection on snak.cz. The low detection count suggests that the payload or landing page may be newly crafted or that existing signatures have limited coverage. The domain is also present on a single third‑party security blocklist, reinforcing the notion that it has been observed in phishing‑related activity, although the specific campaign details, target brand, or lure vector have not been disclosed in the available intelligence.

The active status of the domain, combined with its inclusion on a known phishing blocklist, warrants immediate mitigation. Defensive teams should add 95.168.219.153 to network‑level deny lists, enforce DNS‑level blocking of snak.cz, and monitor TLS‑certificate transparency logs for any future certificate issuance that could indicate a shift toward HTTPS. Continuous re‑query of VirusTotal and other reputation services is advised to capture any change in detection prevalence. Because the content of the site has not been publicly analyzed, analysts should treat any inbound traffic to the domain as potentially malicious and isolate it pending deeper forensic examination.