sniper-76i[.]pages[.]dev

PhishDestroy identifies sniper-76i.pages.dev as a confirmed phishing site operating under the guise of a browser-based sniper game. This domain poses an active credential-harvesting threat, tricking users into submitting usernames and passwords under the pretense of “unlocking premium weapons” or similar in-game rewards. The campaign is designed to harvest high-value login credentials that attackers can reuse across gaming platforms and, more dangerously, enterprise or banking portals where password reuse is common.

This domain was flagged with zero detections on VirusTotal (2/95 engines), indicating it has yet to be widely recognized by automated scanners despite hosting malicious content. It resolves to IP address 188.114.96.3, a Cloudflare-announced IP within the 188.114.64.0/18 range, historically associated with bulletproof hosting and bullet-resistant services. The domain is registered through Cloudflare, Inc., leveraging their free SSL certificate via Let’s Encrypt to simulate legitimacy and bypass browser warnings. While creation timestamps and blocklist data remain unverified in public feeds, the combination of low detection rate, hostile IP reputation, and SSL certificate issuance strongly suggests a newly deployed or obfuscated phishing operation.

To mitigate exposure, users must avoid accessing sniper-76i.pages.dev entirely. Ensure your browser, antivirus, and DNS filters are updated to block 188.114.96.3. Enable two-factor authentication on all gaming and secondary accounts to prevent credential reuse attacks. Report the domain to Cloudflare Abuse (abuse@cloudflare.com) and your local CERT. If credentials were entered, rotate passwords immediately and monitor linked accounts for unauthorized access.