shibone[.]top

The domain shibone.top was registered on 20 July 2025 through NiceNIC International Group Co., Limited and is currently listed as offline. Technical inspection shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are hans.ns.cloudflare.com and pat.ns.cloudflare.com, confirming that the hosting infrastructure is provided by Cloudflare. No TLS certificate was observed, indicating that the site was served over plain HTTP.

The page title returned by the server is “Nur einen Moment…”, which does not reveal any obvious target brand or service and suggests a placeholder or waiting page. Threat intelligence indicates that shibone.top appears on three public blocklists—PhishDestroy, ScamSniffer, and Enkrypt—each of which categorises it as a phishing resource. VirusTotal scans show that five of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent. Additionally, Gridinsoft assigns the domain a trust score of 0 out of 100, the lowest possible rating.

Because the infrastructure is hosted behind Cloudflare, the IP address may be shared with benign customers, so blocking the IP alone could generate false positives. Defenders should therefore add shibone.top to URL filtering and domain‑based deny lists, ensure that any outbound connections to the domain are denied, and monitor for newly registered domains that resolve to the same Cloudflare nameservers or exhibit similar page‑title patterns. Continuous re‑query of blocklist feeds and VirusTotal for this domain is advised, as the threat landscape may evolve if the site is re‑activated. Until further evidence emerges, the evidence base strongly supports treating shibone.top as a malicious phishing endpoint.