financeglobal[.]lat

The domain financeglobal.lat has been flagged as a high-risk phishing site based on multiple concrete threat indicators and recent activity. Analysis reveals the domain was registered on August 04, 2026, through HOSTINGER operations, UAB, and is currently active and resolving to IP address 104.21.76.249. Its infrastructure uses Cloudflare nameservers (bradley.ns.cloudflare.com and daniella.ns.cloudflare.com), which is typical for obfuscation and rapid deployment by threat actors.

The domain is currently listed on three significant security blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating direct evidence of malicious activity and active defensive measures by industry partners. VirusTotal analysis shows the domain was scanned by 91 vendors, none of which currently flag it; however, the absence of detections is not definitive proof of safety and does not override blocklist evidence. At this time, the exact content or target of the phishing campaign remains unanalysed, as no page title, brand targeting, or scam kit details are available.

The domain’s recent creation, rapid blocklist inclusion, and ongoing operational status increase its threat profile, especially given its association with finance-related keywords. Defenders are advised to treat financeglobal.lat as a confirmed phishing threat, immediately block access in corporate and personal environments, and monitor for related domains or IP addresses. Continued vigilance is recommended, as new evidence may emerge as the site remains active.