claim[.]shapeportal[.]icu

Domain claim.shapeportal.icu has been flagged as an active crypto drainer infrastructure, potentially harvesting cryptocurrency wallet credentials and transaction approvals. No specific brand impersonation has been identified in this campaign, but the domain's structure suggests a fraudulent portal designed to trick users into connecting wallets for unauthorized fund transfers. The domain leverages a crypto drainer kit, likely configured to intercept blockchain transactions and siphon funds to attacker-controlled addresses. Initial analysis indicates this may be a newer operation, given the domain's recent creation and low detection rate on threat intelligence platforms.

Exact technical indicators include a VirusTotal detection score of 2 out of 95 engines as of the latest scan, confirming minimal prior exposure. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently resolving to IP address 188.114.96.3. The infrastructure employs a Let's Encrypt SSL certificate, likely to establish a false sense of legitimacy. Notably, the domain was created on March 28, 2026, which is unusually recent for a domain engaged in malicious activity, suggesting this campaign may still be in its early deployment phase. Google Safe Browsing (GSB) status and blocklist counts remain unverified at this time, pending further aggregation of threat intelligence from partner networks.

As of this advisory, the domain remains active and the threat status is classified as under investigation, with no confirmed detections in major blocklists. Immediate defensive actions include blocking the domain and associated IP at the network perimeter via DNS sinkholing or firewall rules. Users should be cautioned against visiting or interacting with this domain, particularly those transacting in cryptocurrency. Organizations are advised to audit web proxy logs for access to this domain and monitor endpoints for unauthorized wallet connections. While the risk level is currently under investigation, the combination of zero detections and active infrastructure necessitates proactive blocking to prevent potential financial loss. The unique seed identifier efb832 has been assigned to this advisory for tracking consistency across threat intelligence feeds.