shibar[.]eu

On July 23, 2026 the domain shibar.eu was observed hosting a malicious page that claims to be a “REWARD Portal v2 | Latest Web3 Wallets”. The page title explicitly references Web3 wallets and aligns with the declared impersonation of the Trust Wallet brand. Technical analysis shows the domain resolves to IP address 209.94.90.1, which is located in the United States and is announced by ASN 40680 belonging to Protocol Labs. The hosting infrastructure is fronted by Cloudflare, with nameservers betty.ns.cloudflare.com and javon.ns.cloudflare.com, and the service is reachable over HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the use of a legitimate Certificate Authority but offering no legitimacy to the content.

An HTTP request to the root URL returns a 403 status code, indicating that direct access is denied, yet the malicious content was still indexed by security tools. VirusTotal scans recorded 14 detections out of 95 scanning engines, confirming a notable threat presence. The domain appears on one public blocklist and is specifically listed by the PhishDestroy blocking service. AlienVault OTX references the domain in a single threat‑intelligence pulse, further corroborating its malicious use. Registration information reveals the domain was purchased through Dynadot LLC, a registrar frequently seen in abuse cases.

The observed activity matches the “Wallet/Seed Phishing” category, aiming to harvest cryptocurrency wallet seeds from victims who believe they are interacting with a legitimate Trust Wallet service. As of the report date the domain has been taken offline, but the infrastructure components—including the Cloudflare front‑end and the IP address owned by Protocol Labs—remain active and could be repurposed for future campaigns.