shiftinridgepath[.]icu

Analysis indicates that shiftinridgepath.icu is an active phishing domain registered on April 21, 2026, through Dynadot LLC. The domain currently resolves to the IP address 91.92.241.168 and utilizes Cloudflare nameservers (meg.ns.cloudflare.com and peter.ns.cloudflare.com), a common infrastructure choice for threat actors seeking to obscure hosting origins. As of July 20, 2026, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 13 of 95 security vendors on VirusTotal, suggesting detection by multiple threat intelligence sources. The domain's registration details and hosting provider do not align with known legitimate services, further supporting its classification as malicious. No specific brand impersonation or phishing kit has been confirmed in the available data, so the exact content and target of the phishing campaign remain unanalyzed. However, the combination of Cloudflare nameservers, a recently registered domain, and detection by security vendors indicates a high likelihood of credential-harvesting or other fraudulent activity. Defenders should treat this domain as a confirmed phishing threat and implement blocking measures at the network and endpoint levels. Monitoring for additional detections or changes in infrastructure, such as IP or nameserver updates, is recommended to track the campaign's evolution. If further analysis of the site's content becomes available, it may reveal specific tactics or targeted brands, but current evidence supports immediate containment actions.