signup-shape[.]xyz

signup-shape.xyz was detected by the SOC on July 25, 2026 as part of a routine phishing sweep. The domain resolves to 104.21.95.202, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Registration records indicate the domain was created on 23 February 2026 through Dynadot LLC, and authoritative name servers are listed as alexa.ns.cloudflare.com and randall.ns.cloudflare.com. TLS negotiation presents a certificate issued by Google Trust Services under the WE1 root, confirming standard Cloudflare SSL termination.

HTTP probing returned a 404 status code, and the page title reported “504: Gateway time-out”, indicating the service is presently non‑responsive and the host is taken offline. Threat intelligence sources have added the domain to three security blocklists, and it is currently blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows 2 of 93 scanning engines flag the domain, providing a low‑to‑moderate detection signal. The observed infrastructure—recent registration, Cloudflare front‑end, and inclusion on multiple blocklists—is consistent with short‑lived phishing infrastructure used to harvest credentials or deliver malicious payloads.

No additional content, payload, or campaign specifics have been captured because the site is offline, leaving the exact phishing vector uncertain. Defenders should continue to deny DNS resolution and HTTP access to the domain, propagate the block to proxy and firewall policies, and monitor the IP address 104.21.95.202 for any re‑use. Ongoing surveillance of the Dynadot registrar and the associated Cloudflare name servers is advised to catch potential re‑registration or redeployment of the same host name.