digitalshitcoin[.]fun

This domain, digitalshitcoin.fun, is flagged as an active phishing site targeting cryptocurrency users. Analysis indicates the domain was registered on August 28, 2025, through a privacy-focused registrar, with nameservers hosted under porkbun.com. The domain resolves to IP address 75.2.60.5, part of Amazon.com, Inc.'s infrastructure (AS16509), a common hosting provider for both legitimate and malicious sites. The HTTP response status is 200, confirming the site is currently accessible, though the page title 'Helt svart tom websida' (Swedish for 'Completely black empty webpage') suggests either a placeholder or obfuscation tactic to evade detection. The domain appears on at least one security blocklist and is flagged by 2 out of 95 vendors on a widely used malware and phishing detection platform. While the exact nature of the phishing content is not yet confirmed, the domain name itself implies a focus on cryptocurrency, a frequent target for credential harvesting, fake wallet schemes, or fraudulent investment platforms. The SSL certificate, issued by a trusted provider, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Defenders should treat this domain as high-risk due to its active status, recent registration, and association with known phishing indicators. Network-level blocking is recommended for organizations, particularly those handling cryptocurrency transactions or user credentials. Further analysis of the site's content, if accessible, may reveal additional indicators such as phishing kits, redirect chains, or embedded malicious scripts. Monitoring for related domains or subdomains under the same registrar or hosting provider could uncover broader campaign infrastructure.