shibagain[.]xyz

This domain, shibagain.xyz, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare's network (ASN 13335) with the public address 172.67.200.35 located in the United States. The domain resolves to two Cloudflare authoritative name servers, malcolm.ns.cloudflare.com and sydney.ns.cloudflare.com, and serves a site protected by HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 root. When accessed prior to takedown, the only observable page element was the title “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s automated block page was triggered. The site has been taken offline, and the current HTTP status is unavailable.

Threat intelligence sources have classified the domain as a generic phishing vector; eight of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single external blocklist. The blocklist entry was also reported by PhishDestroy, confirming that the domain was actively used for malicious credential harvesting before removal. No additional artifacts such as payload samples, phishing email copies, or targeted brand references have been published, leaving the exact lure and victim profile unknown.

Defenders should continue to block the IP address 172.67.200.35 and the domain name at DNS or proxy layers, monitor for newly registered domains using the same registrar or similar naming patterns, and consider adding the domain to internal blocklists. Ongoing observation of Cloudflare‑hosted infrastructure is advised, as the service can be reused for future campaigns. Given the recent creation date and the short window of activity, the risk rating remains elevated until further contextual indicators emerge.