nipshubs[.]com

Analysis of the domain nipshubs.com, first observed on 23 February 2026, shows that it is actively serving a fraudulent investment portal. The site presents the page title “Online Crypto Trading Platform – Safe investment with Online Crypto Trading Platform”, indicating a lure toward cryptocurrency trading. The domain is registered through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the Cloudflare‑owned address 172.67.184.5, which is associated with ASN 13335 in the United States. The hosting infrastructure utilizes Cloudflare DNS (adel.ns.cloudflare.com, oswald.ns.cloudflare.com) and HTTP/3, and the SSL certificate is issued by Google Trust Services under the WE1 profile, confirming a valid TLS termination. Content delivery includes third‑party libraries Smartsupp, jQuery and CreateJS, as well as Cloudflare Browser Insights, all of which are typical of legitimate sites but do not mitigate the malicious intent.

The HTTP response code is 200, indicating successful content delivery. A Gridinsoft trust score of 0/100 further reflects a high risk assessment. VirusTotal scans have flagged the domain by five of ninety‑three security vendors, and the site is listed on three external blocklists, with active blocks applied by PhishDestroy, MetaMask and SEAL. The combination of a recent registration date, low trust score, multiple vendor detections, and inclusion on dedicated anti‑phishing blocklists strongly supports the classification as an investment‑type phishing operation.

Uncertainty remains regarding the exact payload or credential harvesting mechanisms, as the site’s internal structure and form fields have not been disclosed. No additional intelligence on command‑and‑control endpoints or malware distribution has been observed. Defenders should block the domain and its resolved IP at network perimeters, add the domain to URL filtering and email security policies, and monitor for any use of the associated Cloudflare nameservers in outbound traffic.