idos[.]lat

This domain, idos.lat, is actively serving a phishing page impersonating the idOS App, a decentralized identity platform. Analysis indicates the site was registered on March 13, 2026, through a registrar commonly associated with abusive domains, and is currently resolving to 104.21.18.189, a Cloudflare IP address within AS13335. The infrastructure is proxied behind Cloudflare, a configuration frequently exploited by threat actors to obscure origin servers and evade takedowns. The site returns an HTTP 200 status, suggesting full operational capacity, and employs a Let's Encrypt SSL certificate, which provides HTTPS encryption but does not validate legitimacy. The page title explicitly references the idOS App, a detail that aligns with credential harvesting tactics targeting users of decentralized identity services. Detection data shows the domain is flagged by three security blocklists and two out of ninety-five vendors on a widely used scanning platform, confirming its malicious classification. The use of Bootstrap and Cloudflare Browser Insights further suggests the deployment of a pre-built phishing kit, though the specific kit variant remains unidentified. While the domain's creation date is recent, the lack of historical reputation data limits attribution to known threat groups. Defenders should treat this domain as a high-risk asset due to its active status, confirmed phishing intent, and association with cryptocurrency fraud. The Cloudflare nameservers and IP address provide potential pivot points for identifying related infrastructure, though these may also host legitimate traffic. Network-level blocking of 104.21.18.189 and the domain itself is recommended, alongside monitoring for user reports of credential theft or unauthorized transactions linked to this site. Given the domain's registration details and hosting provider, additional related domains may emerge, warranting proactive hunting for similar naming patterns or infrastructure reuse.