shibs[.]net

Analysis on shibs.net shows a recent cryptocurrency impersonation campaign targeting Coinbase users. The domain was registered on July 17, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv4 address 92.113.16.74, which is hosted in Germany under AS47583 owned by Hostinger International Limited. The TLS certificate presented is a ZeroSSL RSA Domain Secure Site CA certificate, indicating a publicly issued but inexpensive certificate often used by malicious operators. The page title returned during the last crawl was "Shiba Inu Airdrop", a phrasing commonly employed to lure victims with promises of free token distribution. The campaign is classified as a crypto scam and specifically impersonates the Coinbase brand, as indicated in the provided intelligence.

The domain appears on one security blocklist and is listed by PhishDestroy as blocked. VirusTotal records show that one of ninety‑three security vendors flagged the domain, confirming at least one independent detection. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. No additional content or login forms have been captured, so the exact page layout and credential‑harvesting mechanisms remain unknown.

Defenders should immediately deny any network traffic to 92.113.16.74 and add shibs.net to DNS‑based blocklists. Monitoring for newly registered domains that resolve to the same hosting provider or that use similar "Airdrop Scam" kits is advised. Given the impersonation of Coinbase, security teams should update email filters for phishing attempts referencing "Shiba Inu Airdrop" or similar cryptocurrency giveaways. Although the site is currently offline, the infrastructure may be reused, so continuous threat‑intel feeds should be consulted for re‑appearance.