gmgnsnipertools[.]team

This domain, gmgnsnipertools.team, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and subsequently resolved to the IPv4 address 94.183.234.240, which is hosted in Finland under ASN 56971 (Cloud). The web server identified by banner analysis runs Ubuntu with Nginx, and the site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8). The page title returned by HTTP requests is identical to the domain name, “gmgnsnipertools.team”. DNS queries reveal authoritative nameservers ns3.my-ndns.com and ns4.my-ndns.com.

Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating a lack of confidence in the host. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service. VirusTotal analysis recorded six detections out of ninety‑three scanned vendors, reinforcing the suspicion of malicious intent. The risk level assigned by the reporting system is elevated, and the current operational status is offline, suggesting the site has been taken down or is no longer reachable.

Evidence confirms that the infrastructure is consistent with typical phishing‑hosting patterns, yet the specific payload or targeted brand has not been disclosed in the available data. The absence of additional public blocklist listings or broader vendor consensus leaves uncertainty regarding the full scope of the campaign. Defenders should continue to monitor the IP address 94.183.234.240 for any re‑activation, enforce DNS‑level blocking of the domain and its authoritative nameservers, and incorporate the observed indicators—domain name, IP, SSL certificate fingerprint, and the six VirusTotal vendor detections—into intrusion‑detection and endpoint‑protection rules.