fabrics[.]lat

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

The domain fabrics.lat was registered on May 08 2026 through PublicDomainRegistry.com and is currently delegated to the Cloudflare nameservers liv.ns.cloudflare.com and michael.ns.cloudflare.com. DNS resolution points to the IP address 172.67.216.46, which belongs to Cloudflare’s network in Canada. HTTPS service is provided by a Let’s Encrypt certificate (identifier YE2) and the web server returns HTTP 403 for all requests, indicating that direct content retrieval is being denied. The domain is listed on three public security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. AlienVault OTX records show the domain appearing in sixteen separate threat‑intel pulses, reinforcing its association with phishing campaigns. VirusTotal analysis shows zero detections out of ninety‑five engines, which reflects the lack of known malicious payloads at the time of scanning rather than an indication of safety. The combination of a recent registration, Cloudflare‑hosted infrastructure, a valid TLS certificate, and active blocklist listings suggests a purpose‑built phishing site that is currently restricting public access, likely to evade automated crawlers while targeting specific victims. Defenders should proactively block fabrics.lat at the DNS or proxy level and consider denying traffic to its underlying IP 172.67.216.46, recognizing that the address is shared among many legitimate Cloudflare customers. Monitoring for credential‑submission attempts to the domain, inspecting TLS handshakes for the Let’s Encrypt YE2 certificate, and correlating any user‑reported phishing emails with this indicator will help contain potential compromise. Continuous re‑evaluation is advised as the site may become reachable if the threat actor lifts the 403 restriction.