dustcoin[.]sbs

This domain, dustcoin.sbs, was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the Cloudflare IP address 188.114.97.3 located in Canada and uses the nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com. The site presents a valid Let's Encrypt certificate (issuer E7) but returns HTTP 403 for direct requests, a pattern often seen in credential‑harvesting fronts that block automated scans.

Reputation services have flagged dustcoin.sbs across three public blocklists. It is actively blocked by three independent mitigation platforms, and three security vendors on VirusTotal have raised detections, yielding a 3/95 flag count. An AlienVault OTX pulse also references the domain, indicating that at least one community‑generated indicator set includes it.

The infrastructure receives a Gridinsoft trust score of 0 out of 100, underscoring its malicious intent. Combined with the high‑risk classification and the observed use of Cloudflare’s edge network, the evidence points to a generic phishing campaign likely targeting cryptocurrency users, leveraging the “dustcoin” brand to lure victims into credential submission.

Defenders should add dustcoin.sbs to deny‑list rules on DNS resolvers and web proxies, enforce TLS inspection to capture any credential payload, and monitor for outbound connections to 188.114.97.3. Continuous harvesting of newly observed C2 endpoints and periodic re‑evaluation of the domain’s status are recommended to mitigate potential re‑use.