shimmer-kernel[.]digital

shimmer-kernel.digital is presently taken offline, but registration records show it was created on 25 February 2026 through Dynadot LLC. Historical DNS resolution points to the IP address 104.21.39.23, which belongs to Cloudflare’s network (AS13335) and is geolocated to the United States. The domain’s authoritative nameservers are jerome.ns.cloudflare.com and naya.ns.cloudflare.com, confirming that the infrastructure relied on Cloudflare’s DNS and edge services, including support for HTTP/3. The site’s only observed content is the page title “Shimmer Kernel Academy – IT Support & Service Desk,” indicating an attempt to pose as an IT support or academic service, though no further brand attribution is evident. Security telemetry shows that three of ninety‑three VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent.

The SSL certificate is issued by Let’s Encrypt (identifier E8), which is typical for short‑lived phishing sites. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing resource. Defenders should continue to block the domain at perimeter firewalls and proxy devices, monitor for any resurgence of the host or related sub‑domains, and update URL filtering policies to include the listed blocklist identifiers.

Given the Cloudflare front‑end, any future re‑hosting could reuse the same IP range, so threat‑intel feeds should be consulted for new activity tied to 104.21.39.23. Analysts should also watch for similar page‑title patterns that reference “Shimmer Kernel Academy” as potential indicators of campaign reuse. Until the site is confirmed inactive, maintaining the current blocklist entries and enforcing strict email‑filtering rules for messages claiming to originate from the purported academy is advised.