ibtoken[.]sbs

This domain ibtoken.sbs is currently active and has been classified as a high‑risk generic phishing site employing brand impersonation. The site presents the page title “Just a moment…”, which is a common placeholder used in malicious landing pages. The domain was registered on 21 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare’s network (IP 188.114.96.3, located in Canada). DNS resolution uses Cloudflare name servers june.ns.cloudflare.com and nikon.ns.cloudflare.com. TLS is provided by a Let’s Encrypt certificate (issuer E7), and an HTTP request returns a 403 status code, indicating that direct access is denied without additional parameters. Intelligence feeds show the domain appears on three security blocklists and has been referenced in one AlienVault OTX pulse. VirusTotal analysis recorded six detections out of ninety‑four scanners, and the domain is already blocked by PhishDestroy, MetaMask, and SEAL. The combination of recent registration, Cloudflare front‑end, and low‑visibility HTTP response aligns with typical phishing infrastructure used to hide payload delivery. Defenders should add ibtoken.sbs to outbound web‑filter deny lists, monitor DNS queries for this host, and correlate any authentication attempts that reference the domain with user activity logs. Because the actual page content beyond the title has not been publicly disclosed, further sandbox or manual inspection is advised if the site becomes reachable. Continuous threat‑intel updates are recommended to capture any evolution of the campaign.