shiftly[.]at

This domain is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the site mimics a legitimate cryptocurrency exchange platform, likely designed to harvest wallet credentials, private keys, or facilitate fraudulent transactions. The specific threat involves social engineering tactics to deceive users into divulging sensitive authentication details under the pretense of a premium crypto trading service. Infrastructure analysis reveals the domain shiftly.at was registered on February 21, 2026, through Realtime Register B.V., resolving to IP address 168.231.117.60 (AS47583, Hostinger International Limited, Lithuania). The domain lacks an SSL certificate, increasing exposure to man-in-the-middle interception. VirusTotal detection rates show 14 out of 95 security vendors flagging the domain as malicious. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'Shiftly | Premium Crypto Exchange,' directly aligns with Ethereum-related phishing patterns, further corroborating its fraudulent intent. Mitigation requires immediate domain blacklisting across all network security controls, including DNS filtering, web gateways, and endpoint protection systems. Security teams should prioritize monitoring for connections to 168.231.117.60 and alert on any internal traffic attempting to resolve shiftly.at. Users should be educated on verifying domain authenticity before entering wallet credentials, particularly for platforms claiming affiliation with Ethereum or other blockchain services. Incident responders should treat any interaction with this domain as a potential credential compromise and initiate password resets or wallet migration procedures for affected accounts.