snapninja[.]io

Analysis of snapninja.io shows that the domain was registered on February 21, 2026 and is presently taken offline. The site presented the page title “SecretSnap - Découvre ce que cache ton partenaire”, which references the targeted brand “ton”. The content aligns with a brand‑impersonation scam, as indicated by the supplied scam type. Infrastructure inspection reveals that the domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented on the host is identified as WE1, confirming that HTTPS is enabled but offering no additional authentication value. Reputation checks are uniformly negative.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one security blocklist. AlienVault OTX lists the domain in a single threat‑intelligence pulse, confirming its inclusion in external monitoring feeds. VirusTotal scanned the domain and reported three detections out of ninety‑three scanned security vendors, reinforcing the malicious classification. An independent phishing mitigation service, PhishDestroy, has also blocked the domain. The available data do not disclose the registrar used for the registration, nor any additional hosting details beyond the Cloudflare front‑end.

No further page content, such as login forms or payloads, has been captured, leaving the exact phishing workflow uncertain. Likewise, the specific phishing kit or malware payload, if any, remains unidentified. Defenders should add snapninja.io to internal block lists, monitor DNS queries for the associated IP address, and enforce the blocking of the domain at network perimeter devices. The presence of the domain on existing blocklists and the low trust score merit immediate inclusion in security policies. Continuous re‑evaluation is advised in case the domain reappears or is re‑registered, given the short lifespan typical of impersonation campaigns.