wormhole[.]lat

Analysis of wormhole.lat indicates that the domain was registered on 21 February 2026 through Dynadot LLC and promptly pointed to Cloudflare’s network (AS13335) at IP 188.114.96.3 located in the United States. The hosting arrangement uses Cloudflare’s DNS service, as evidenced by the authoritative name servers ashley.ns.cloudflare.com and dimitris.ns.cloudflare.com. The site presented the page title “Portal Token Bridge | Fast and Secure Cross-Chain Transfers”, which suggests an attempt to lure victims interested in blockchain or cross‑chain services. The SSL certificate is issued by Google Trust Services under the WE1 profile, confirming that TLS termination is performed by Cloudflare’s edge infrastructure. Multiple defensive feeds have flagged the domain.

PhishDestroy has listed wormhole.lat as blocked, and Google Safe Browsing categorises it as a social‑engineering threat. VirusTotal reports that 14 of 93 scanned scanners classify the domain as malicious, providing additional corroboration of phishing activity. The domain appears on one publicly known blocklist, reinforcing its malicious reputation. The threat is classified as brand impersonation, consistent with the generic phishing label supplied. The current HTTP status is offline, indicating that the site has been taken down or is otherwise not serving content at the time of analysis.

No further content, redirects, or payloads have been captured, leaving the exact phishing flow unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts, and add the associated IP address 188.114.96.3 to deny‑list rules. Because the domain leverages Cloudflare, any future resurrection may occur under different sub‑domains, so threat‑intel feeds should be consulted regularly.