shibgift[.]top

shibgift.top was registered on 15 Oct 2025 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335) at IP 188.114.97.3. The domain resolves to a Cloudflare edge node located in the United States and presents no TLS certificate, confirming that the site is served over plain HTTP. The only visible artifact is the page title “Um momento…”, which has not been further analysed. Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on one public blocklist and is actively blocked by the PhishDestroy sink‑hole.

VirusTotal reports that 12 of 95 scanned security vendors flag the domain as malicious, consistent with its classification as a generic phishing site. The infrastructure is modest: two Cloudflare nameservers (hans.ns.cloudflare.com, pat.ns.cloudflare.com) are configured, and the domain’s status is currently offline, indicating that the hosting has been taken down or the site is no longer serving content. The available evidence confirms that the domain was used for phishing, but the specific target, payload, or compromised credentials have not been disclosed. No SSL/TLS fingerprint, HTTP response headers, or content snapshots are available, limiting attribution of the exact phishing vector.

Defenders should continue to deny any outbound connections to 188.114.97.3, add the domain to internal deny‑list policies, and monitor for any re‑registration or reuse of the same Cloudflare edge IP. Because the domain is already blocked by PhishDestroy and appears on a public blocklist, integrating those feeds into automated security controls will reduce exposure. Ongoing telemetry collection from DNS logs and any future VirusTotal scans should be reviewed to detect possible resurgence.