claim[.]shapespace[.]xyz

PhishDestroy identifies claim.shapespace.xyz as an active crypto-draining website that silently transfers cryptocurrency from victims' wallets to attacker-controlled addresses. This domain masquerades as a legitimate claim interface but uses obfuscated JavaScript to detect and exploit wallet connections, initiating unauthorized transactions without user consent. The malicious payload is triggered once a wallet is connected, leading to immediate fund exfiltration under the guise of a verification step. This domain was flagged after resolving to IP 188.114.96.3, with a Let's Encrypt SSL certificate issued for legitimacy. It was created on March 30, 2026, through Dynadot LLC, and appears on 1 known security blocklist as of seed 39bc8e. VirusTotal analysis shows 0 detections out of 95 antivirus engines, underscoring the stealthiness of this threat. The domain’s recent registration suggests it is part of a fast-evolving campaign targeting crypto users. If you visited claim.shapespace.xyz, disconnect all wallets immediately and revoke any suspicious permissions via your wallet’s settings or blockchain explorer. Scan your device with updated antivirus software and consider transferring remaining funds to a new, clean wallet. Report the domain to your wallet provider and relevant crypto fraud databases. Exercise caution with any crypto-related websites, especially those with recent domain registrations or untrusted origins.