shapechange[.]xyz

This domain is flagged as an active generic phishing threat with an elevated risk level, specifically functioning as a fake cryptocurrency platform. Analysis indicates the site is designed to mimic legitimate crypto services, likely to harvest credentials or deploy wallet-draining scripts targeting users of digital asset platforms. The infrastructure exhibits characteristics consistent with known crypto-related phishing campaigns, including deceptive page titles and domain registration patterns. Infrastructure analysis reveals the domain shapechange.xyz was registered on March 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.146.219 and is currently detected by 14 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is actively blocked by at least one anti-phishing system. Additional trust metrics, such as a Gridinsoft trust score of 0/100, further corroborate its malicious classification. The page title, 'ShapeChange | Home,' suggests an attempt to impersonate a legitimate crypto exchange or service. Mitigation steps for this specific threat type include immediately blocking the domain and its associated IP address at the network perimeter. Users who may have interacted with the site should revoke any connected wallet permissions and monitor their crypto wallets for unauthorized transactions. Organizations should update endpoint detection rules to flag similar domains registered through PDR Ltd. with recent creation dates. Security teams are advised to correlate this domain with other indicators of compromise, particularly those linked to crypto phishing campaigns, and educate users on recognizing fake crypto platforms.