shapes[.]finance

Analysis of the domain shapes.finance, observed as offline on 24 July 2026, indicates a confirmed phishing infrastructure with an elevated risk rating. The domain was registered on 21 February 2026 through NameCheap, Inc., and resolves to the Cloudflare‑owned address 104.21.16.55, which is associated with ASN 13335 and located in the United States. The hosting environment utilizes Cloudflare services, including HTTP/3 support, and the authoritative name servers are plato.ns.cloudflare.com and stevie.ns.cloudflare.com. The site presented the page title "Shapes — Empowering the brave," but no further content analysis is available. TLS termination is provided by a Google Trust Services certificate issued under the WE1 hierarchy, confirming the use of a reputable certificate authority.

Threat intelligence corroborates malicious activity: AlienVault OTX lists the domain in a single pulse, and VirusTotal reports that two of ninety‑three scanning engines have flagged the domain as malicious. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and the SEAL filtering system. These detections collectively reinforce the classification as a generic phishing site. Uncertainty remains regarding the specific phishing payload or target audience, as no detailed page inspection or victim reports have been published. The offline status limits immediate observation of active content, but the persistence of blocklist entries suggests the site was operational long enough to be indexed by multiple security providers.

Defenders should continue to block or quarantine any traffic to shapes.finance at the DNS, network, or endpoint level. Security appliances that reference the listed blocklists or employ reputation scoring should flag the domain as malicious. Incident response teams encountering references to this domain should treat associated URLs as high‑confidence phishing indicators and advise users to avoid interaction.