shapes.finance

Threat intelligence corroborates malicious activity: AlienVault OTX lists the domain in a single pulse, and VirusTotal reports that two of ninety‑three scanning engines have flagged the domain as malicious. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and the SEAL filtering system. These detections collectively reinforce the classification as a generic phishing site. Uncertainty remains regarding the specific phishing payload or target audience, as no detailed page inspection or victim reports have been published. The offline status limits immediate observation of active content, but the persistence of blocklist entries suggests the site was operational long enough to be indexed by multiple security providers.

Defenders should continue to block or quarantine any traffic to shapes.finance at the DNS, network, or endpoint level. Security appliances that reference the listed blocklists or employ reputation scoring should flag the domain as malicious. Incident response teams encountering references to this domain should treat associated URLs as high‑confidence phishing indicators and advise users to avoid interaction.