bloomsniper[.]onl

Analysis indicates that the domain bloomsniper.onl, registered through Porkbun LLC on 10 October 2025, is actively serving HTTP 200 responses backed by Cloudflare’s network (AS13335, United States). The site presents a TLS certificate issued by Google Trust Services (CN=WE1), confirming the use of Cloudflare’s SSL termination. Infrastructure fingerprints show the use of Tailwind CSS and HTTP/3, and the authoritative nameservers are arch.ns.cloudflare.com and tegan.ns.cloudflare.com. The page title returned by the server is “Bloom Sniper,” and the domain is classified as a brand‑impersonation campaign targeting the “across” brand. VirusTotal reports three detections out of ninety‑five scanners, and the domain is listed on one public blocklist. It has already been flagged by the PhishDestroy mitigation service, and Gridinsoft assigns a trust score of 0 / 100. The observable surface suggests a typical malicious‑hosting setup, but no payload or credential‑capture page has been disclosed publicly. Defenders should add bloomsniper.onl to deny‑list rules, monitor outbound DNS queries for this host, and enforce TLS inspection to capture any malicious payloads. Continuous re‑evaluation is recommended, as the short registration age (less than one year) and active status imply the campaign may evolve.