snupay[.]net

The domain snupay.net has been identified as a phishing site engaged in brand impersonation, specifically mimicking the cryptocurrency exchange Avalanche. This impersonation poses a risk of leading users to believe they are interacting with a legitimate Avalanche service, potentially resulting in financial loss or credential theft. The site is currently taken offline, but users who may have interacted with it should remain vigilant.

snupay.net has been flagged by 2 of 95 security vendors on VirusTotal, including Bfore.Ai PreCrime and Gridinsoft, and it appears on 1 security blocklist, PhishDestroy. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on July 28, 2024, and resolves to the IP address 172.67.160.136, located in the US under AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1. The page title observed was 'Buy/Sell Bitcoin, Ether and Altcoins | Cryptocurrency Exchange | Snupay', and the site used technologies such as Node.js, Vue.js, Nginx, Express, Cloudflare, and HTTP/3.

Users who have interacted with snupay.net should take immediate steps to protect their assets and personal information. For those who may have entered their Avalanche credentials, it is recommended to change passwords and enable two-factor authentication (2FA) on all related accounts. Additionally, users should monitor their Avalanche and other cryptocurrency wallets for any unauthorized transactions and consider moving their funds to a new, secure wallet. To report this phishing site, users can submit the domain to Google Safe Browsing, VirusTotal, and other relevant security platforms.