bloomsniper[.]world

This domain is flagged as a credential harvesting phishing threat with an elevated risk level. Analysis indicates it is designed to mimic legitimate login portals, tricking users into submitting sensitive information such as usernames, passwords, or financial details. The domain exhibits characteristics consistent with targeted phishing campaigns, including deceptive subdomains or cloned interfaces of trusted services. Infrastructure analysis reveals the following technical indicators: bloomsniper.world was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolves to the IP address 188.114.97.3. It appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal. The domain is also referenced in one threat intelligence pulse on a public threat intelligence platform and has a Gridinsoft trust score of 0/100. The domain is currently offline, but its infrastructure may be repurposed for future attacks. Mitigation steps specific to this threat type include blocking the domain and its associated IP (188.114.97.3) at the network perimeter. Security teams should monitor for any attempts to access this domain or IP within internal logs, as this may indicate compromised endpoints or ongoing phishing attempts. End-users should be educated on identifying phishing tactics, such as scrutinizing URLs, avoiding unsolicited login requests, and verifying the legitimacy of websites before entering credentials. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.