shibuk[.]top

This domain is flagged for elevated-risk brand impersonation targeting Trust Wallet users through a fraudulent REWARD Portal v2 interface. Analysis indicates the infrastructure is designed to harvest cryptocurrency wallet credentials under the guise of Web3 wallet rewards, a common tactic in cryptocurrency phishing campaigns.

Infrastructure analysis reveals the domain shibuk.top was registered on October 2, 2025, through NiceNIC International Group Co., Limited. It resolves to the IPv6 address 2602:fea2:2::1 and has been detected by 2 out of 95 security vendors on VirusTotal. The domain appears in one AlienVault OTX threat intelligence pulse and is listed on one security blocklist, specifically blocked by PhishDestroy. Additional trust scoring from Gridinsoft assigns a 0/100 rating, further confirming its malicious nature. The page title "REWARD Portal v2 -- Latest Web3 Wallets" directly aligns with known phishing patterns targeting cryptocurrency users.

Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address at the network perimeter. Cryptocurrency users should be alerted to verify wallet reward claims through official Trust Wallet channels only, avoiding any interaction with unsolicited reward portals. Security teams are advised to monitor for similar domains registered through NiceNIC or resolving to 2602:fea2:2::1, as these may indicate related phishing infrastructure. Wallet providers should proactively warn users about fake reward schemes and implement multi-factor authentication for sensitive transactions.