shibs[.]eu

The domain shibs.eu was observed hosting a site titled “REWARD Portal v2 | Latest Web3 Wallets” and actively impersonates the Trust Wallet brand. Infrastructure analysis shows the domain is delegated to the Cloudflare nameservers dimitris.ns.cloudflare.com and journey.ns.cloudfl, resolving to the IP address 209.94.90.1, which belongs to AS40680 (Protocol Labs) and is geolocated in the United States. No TLS certificate is presented, indicating the site is served over plain HTTP. The registrar listed is Dynadot LLC. Threat intelligence from VirusTotal reports that fifteen of ninety‑five scanning engines flag the domain as malicious, and the site appears on one public blocklist.

It has also been added to the PhishDestroy blocklist, confirming its classification as a wallet/seed phishing campaign. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the high‑risk assessment. The observed page title and the explicit “trust wallet” impersonation suggest a credential‑ harvesting operation targeting cryptocurrency users, consistent with the reported scam type of wallet/seed phishing. However, no additional samples of the phishing kit, screenshots, or URL paths have been released, leaving the exact lure mechanisms and credential capture endpoints uncertain.

Defenders should block DNS resolution for shibs.eu at the network perimeter, enforce TLS inspection to capture any future encrypted traffic, and add the associated IP address 209.94.90.1 to threat‑intel feeds. Monitoring for similar domains using the same Cloudflare nameservers or the same AS may reveal related infrastructure. Users of Trust Wallet should be warned not to enter seed phrases or credentials on any site presenting the “REWARD Portal v2” title, and organizations should update email and web filters to block references to this domain.