shapecoin[.]lat

The domain shapecoin.lat has been identified as a high-risk phishing threat, with a registration date of March 9, 2026. It currently resolves to the IP address 188.114.96.3, which is associated with known malicious activities. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and has been flagged by 16 out of 95 security vendors on VirusTotal, indicating a significant level of concern regarding its legitimacy. Additionally, it has been blocked by multiple security services including SEAL and PhishDestroy, further corroborating its malicious intent.

The domain has been found on five distinct security blocklists, suggesting that it is actively monitored and recognized as a threat across various platforms. A trust score of 0/100 from Gridinsoft indicates a complete lack of credibility. The domain appears in 23 threat intelligence pulses on AlienVault OTX, which shows a consistent recognition of its harmful activities. The use of Cloudflare technologies, including Cloudflare Browser Insights and HTTP/3, suggests an attempt to obfuscate its true intent and shield it from detection.

While the presence of an SSL certificate issued by Let's Encrypt does not inherently indicate safety, it is often employed by malicious entities to lend credibility to their phishing attempts. The page title, 'Just a moment...', typically signifies a loading or redirecting page, which is commonly used in phishing schemes to create a false sense of security.

Defenders are advised to block traffic to shapecoin.lat and monitor for any related domains or IPs that may emerge. Continuous analysis of threat intelligence feeds is essential to stay updated on any developments related to this domain. Organizations should educate users about the risks associated with phishing sites and implement robust email filtering to prevent potential compromises.