lognatera[.]com

Domain lognatera.com is assessed as a high-risk credential theft infrastructure. Analysis indicates an active generic phishing operation designed to intercept user authentication data through deceptive login interfaces. The current status is active, with infrastructure still resolving despite intermittent service disruption indicated by a 522 timeout response.

Technical telemetry shows the domain was flagged by 17 of 95 VirusTotal security vendors and appears on 5 security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The domain was registered via NameCheap, Inc., and created on October 06, 2025. It resolves to IP 104.21.82.112 and is hosted under AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), indicating use of a valid certificate despite malicious classification. These combined indicators reflect a common evasion pattern where legitimate TLS is used to increase perceived trust.

Mitigation requires immediate blocking of the domain at DNS and proxy layers and monitoring for related infrastructure using similar naming patterns. Any credentials entered on associated pages should be considered compromised and reset immediately. Security teams should enforce MFA on impacted accounts, review authentication logs for unauthorized access attempts, and deploy threat intelligence updates to include the listed IP, registrar pattern, and blocklist associations. Continuous monitoring is recommended due to the domain’s active status and likelihood of redeployment under similar infrastructure.