go-shib[.]com

This domain, go-shib.com, is associated with a crypto wallet drainer scheme designed to steal cryptocurrency from victims by tricking them into connecting their digital wallets. Once a user links their wallet to the site, malicious scripts automatically drain funds to attacker-controlled addresses without further interaction. The threat primarily targets users of decentralized finance (DeFi) platforms, particularly those interacting with Shiba Inu-themed tokens or services, though the exact brand impersonation may vary across campaigns.

Analysis indicates the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently observed in phishing infrastructure. Only 1 of 95 security vendors on VirusTotal currently flags the domain, suggesting either early-stage deployment or evasion techniques. The site resolves to IP address 104.21.27.29, a Cloudflare-associated address that may obscure the true hosting provider. The SSL certificate, issued by Google Trust Services (WE1), is legitimate but does not validate the site's content. The observed page title, 'Default Web Site Page,' suggests either misconfigured or intentionally minimalist infrastructure to avoid detection.

If you visited go-shib.com and connected a cryptocurrency wallet, assume your funds are at risk. Immediately disconnect the wallet from all dApps, revoke any suspicious token approvals using a blockchain explorer, and transfer remaining assets to a new wallet. Monitor transaction history for unauthorized transfers and report the incident to your wallet provider. Do not interact with the domain or any linked resources, as they may still host malicious payloads even if the primary page appears inactive. Users should also check browser extensions and connected devices for malware, as crypto drainers often deploy additional persistence mechanisms.