snapshot-buildon[.]online

The domain snapshot-buildon.online has been identified as a credential theft phishing site targeting users through impersonation of the BUILDon platform. Analysis indicates the domain was designed to harvest login credentials or sensitive user data under the guise of a legitimate service. Current status confirms the domain is offline, though prior activity aligns with known phishing tactics observed in similar campaigns. Infrastructure analysis reveals the domain was registered on October 06, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.85.166, a Cloudflare-associated endpoint often leveraged to obfuscate malicious infrastructure. Detection metrics include flags from 2 of 95 VirusTotal security vendors, presence on one security blocklist, and a Gridinsoft trust score of 0/100. The page title, 'BUILDon,' further supports the impersonation narrative, as it mirrors the branding of a legitimate development or construction platform. Current status indicates the domain has been taken offline, likely in response to detection and mitigation efforts. However, the infrastructure remains a potential risk for re-emergence under altered domains or IPs. Organizations are advised to block the domain and its associated IP at the perimeter, monitor for related phishing attempts targeting BUILDon users, and implement multi-factor authentication (MFA) to mitigate credential theft risks. Security teams should also review logs for prior connections to 104.21.85.166 and conduct user awareness training on recognizing impersonation tactics.