bloomsniper[.]cfd

Analysis of bloomsniper.cfd indicates it was used for a generic phishing campaign and is currently taken offline. The domain was registered on February 23, 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 104.21.26.57, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. DNS resolution is served by the Cloudflare nameservers dalary.ns.cloudflare.com and fonzie.ns.cloudflare.com. The site presented the page title "Bloom Sniper" and employed Tailwind CSS, Cloudflare services, and HTTP/3 for delivery.

An SSL certificate issued by Google Trust Services (WE1) was observed, confirming the use of standard HTTPS encryption. Security scanning on VirusTotal shows that three of ninety‑three antivirus vendors flagged the domain, suggesting malicious activity. The domain appears on a single external blocklist and has been explicitly blocked by PhishDestroy. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, indicating an extremely low reputation.

Although the site is no longer reachable, the infrastructure fingerprint—Cloudflare‑hosted IP, Tailwind CSS front‑end, and a Google‑issued certificate—matches patterns seen in other phishing operations. Defenders should add 104.21.26.57 to network deny lists, enforce DNS‑level blocking for bloomsniper.cfd, and monitor for newly registered domains that resolve to the same Cloudflare IP range with similar technology stacks. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or its aliases, and endpoint protection solutions should be updated to reflect the three vendor detections reported on VirusTotal.