shibatoken-dashboard[.]org

The domain shibatoken-dashboard.org was observed hosting a wallet/seed phishing page that leverages an airdrop narrative targeting users of CoinMarketCap. The site’s HTML title reads “Shiba Inu Airdrop,” which aligns with the reported kit classification as an “Airdrop Scam.” Registration data indicates the domain was created on 10 August 2025 through NiceNIC International Group Co., Limited, and it utilizes Cloudflare’s DNS infrastructure (daisy.ns.cloudflare.com, elias.ns.cloudflare.com) resolving to the IP address 172.67.131.54, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate was presented at the time of analysis, implying the site operated over plain HTTP. Threat intelligence scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

VirusTotal analysis recorded three detections out of ninety‑five scanners, confirming that multiple security vendors flagged the domain as malicious. The domain appears on a single blocklist and has been actively blocked by the PhishDestroy service, contributing to its current offline status. The observed impersonation of the CoinMarketCap brand suggests an attempt to harvest cryptocurrency wallet credentials or seed phrases from unsuspecting victims. While the specific payload delivery mechanism has not been publicly disclosed, the combination of the airdrop theme and wallet‑seed focus is consistent with known cryptocurrency phishing campaigns.

Defenders should continue to monitor DNS resolutions for the IP 172.67.131.54 and enforce network‑level blocks for the domain and its associated IP range. Adding the domain to internal blocklists, updating endpoint protection signatures, and sharing the indicator set with threat‑sharing communities will reduce the risk of inadvertent user exposure.