snortmainnet[.]live

Analysis indicates that snortmainnet.live is an active phishing domain targeting users with a likely fraudulent cryptocurrency or blockchain-related scheme. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to a Cloudflare-hosted server at 188.114.96.3 (AS13335). Infrastructure analysis reveals Cloudflare nameservers (adi.ns.cloudflare.com, henrik.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services, which are common among both legitimate and malicious sites but do not mitigate the threat in this case. The page title 'Even geduld...' (Dutch for 'Please wait...') suggests a temporary holding or redirect page, often used to mask malicious intent or prepare for a phishing campaign. As of July 12, 2026, the domain returns an HTTP 403 status, indicating access is restricted, which may be a deliberate tactic to evade detection or analysis. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and is flagged by 4 of 93 security vendors in a recent scan, confirming its classification as a high-risk threat. No specific brand or cryptocurrency platform is named in the available data, but the domain name ('snortmainnet') implies a focus on blockchain or decentralized services. Defenders should treat this domain as actively malicious and block it at the network level. Organizations are advised to monitor for connections to 188.114.96.3 and the associated Cloudflare infrastructure, as these may indicate compromised endpoints or ongoing phishing attempts. Further analysis of the domain's content is recommended if additional evidence emerges, but current indicators justify immediate containment.