snapshot-spsc[.]xyz

Analysis of snapshot-spsc.xyz indicates this domain was actively involved in a crypto airdrop scam impersonating Revolut, a known financial services brand. The domain, registered on November 29, 2025, through NiceNIC International Group Co., Limited, resolved to IP address 172.67.164.188, hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was present at the time of assessment, increasing the risk of unencrypted data transmission. The page title, 'Shit Piss Skin Can | Airdrop,' does not align with legitimate financial services branding, further supporting the classification as a fraudulent operation.

Security vendors flagged this domain as malicious, with 4 out of 95 engines on VirusTotal detecting it at the time of scanning. It appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer, both of which specialize in phishing and scam detection. The domain's nameservers (chin.ns.cloudflare.com and newt.ns.cloudflare.com) are consistent with Cloudflare's DNS services, a common choice for both legitimate and malicious sites due to its privacy and resilience features. The domain is currently offline, which may indicate takedown action or voluntary cessation by the threat actor.

However, the infrastructure remains registered and could be reactivated. Defenders should treat this domain as confirmed malicious and prioritize blocking it at DNS, firewall, and endpoint levels. Monitoring for related domains using similar naming patterns (e.g., 'snapshot-' prefixes) or identical infrastructure (Cloudflare IPs, NiceNIC registration) is recommended to preempt potential resurgence. The exact content of the phishing page is not yet analyzed, but the available evidence—including the 'Airdrop Scam' classification—suggests it targeted cryptocurrency users with fraudulent giveaway schemes.