shibad[.]top

Analysis of shibad.top indicates that the domain was registered on 9 September 2025 through NiceNIC International Group Co., Limited. The authoritative name servers are laura.ns.cloudflare.com and will.ns.cloudflare.com, and DNS resolution points to the Cloudflare edge address 104.21.13.153, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented; HTTPS connections are terminated without a valid certificate, which is typical for temporary phishing infrastructure. The HTTP response delivers a page whose title is "Just a moment…", a generic placeholder often used to delay analysis.

The domain currently appears offline, having been taken down or otherwise rendered inaccessible, and it is listed on at least one public security blocklist. Detection services have flagged the domain: two of ninety‑five VirusTotal scanners reported malicious behavior, and PhishDestroy has actively blocked the host. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. The limited detection footprint—only two vendor detections and a single blocklist entry—suggests that the site had a short operational window, which aligns with its recent creation date and rapid takedown.

At present, no SSL certificate, no observed content beyond the placeholder title, and the lack of additional intelligence prevent a more granular attribution of the phishing campaign. Defenders should continue to monitor the IP address 104.21.13.153 for any re‑use, enforce existing blocklist entries, and consider adding the domain to internal deny lists. Because the infrastructure relies on Cloudflare’s shared network, future malicious payloads could be hosted on the same IP range, so broader network‑level controls that filter traffic to Cloudflare edge nodes flagged by threat intelligence are advisable.