shibagrant[.]org

Analysis of shibagrant.org indicates active cryptocurrency-themed phishing infrastructure targeting users of the Shiba Inu (SHIB) ecosystem. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to 188.114.97.3, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The site returns an HTTP 307 Temporary Redirect status, a behavior often used to obscure final landing pages or evade detection. SSL certification is provided by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare’s proxy services.

Infrastructure analysis reveals the use of Node.js, React, Next.js, and Webpack, technologies frequently employed in modern web applications, including phishing kits. The presence of Hotjar and Google Analytics suggests an intent to monitor user interactions, a tactic consistent with credential-harvesting campaigns. The page title, 'Shib.io | Home of the Shiba Inu (SHIB) Ecosystem,' directly references the Shiba Inu cryptocurrency brand, indicating an attempt to deceive users into believing the site is an official or affiliated platform. Detection data shows the domain is flagged by one security blocklist (PhishDestroy) and is identified as malicious by 2 of 93 security vendors on VirusTotal.

Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. While the domain remains active as of July 24, 2026, the limited number of detections may reflect early-stage deployment or evasion techniques. Defenders should treat this domain as hostile infrastructure and block it at the network level. Further investigation into associated IP ranges, nameserver patterns (ezra.ns.cloudflare.com, heidi.ns.cloudflare.com), and redirect chains is recommended to identify related threats.