shape3jobs[.]xyz

shape3jobs.xyz is a currently active crypto-drainer campaign posing as a ‘Venture Analyst – Crypto’ job lure. The domain masquerades as legitimate employment to trick cryptocurrency users into connecting wallets that a drainer kit silently drains. Brand impersonation is not evident; the lure is generic ‘high-paying analyst’ messaging aimed at capturing wallet signatures. No custom drainer kit fingerprint has been publicly released, but the page title and context match known crypto-drainer workflows that exfiltrate tokens on approval or transfer calls.

Technical indicators are consistent with a fast-burn scam. The domain was created on March 29, 2026, registered via NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP 188.114.96.3 and currently carries a Let’s Encrypt SSL certificate. VirusTotal reports 0 detections out of 95 engines, and it is blocked by ScamSniffer on one known security blocklist. Google Safe Browsing has not yet listed the domain.

The domain remains in an under-investigation status with an active threat flag. Immediate risk to any visitor who connects a wallet is high; no wallet approval should be granted. Users should block the domain locally, avoid the page, and report wallet connections to their wallet provider and to ScamSniffer for takedown acceleration. Remaining risk is elevated until major blocklists and VT detections catch up; treat any offer on this domain as malicious and proceed only with extreme caution.