latticevaults[.]net

On July 24, 2026, the domain latticevaults.net was observed as an offline credential‑phishing site. The site served a page whose title reads “Lattice Structure|Login”, indicating an attempt to lure victims into entering credentials for a service that appears to be named Lattice. The domain was registered on March 6, 2026 through Gname.com Pte. Ltd. and delegated to the Cloudflare nameservers christina.ns.cloudflare.com and jeff.ns.cloudflare.com. DNS resolution points to the IP address 104.21.9.50, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 certificate authority, providing a valid HTTPS connection that may increase user trust.

VirusTotal reports that five of ninety‑five scanning engines flagged the domain, and three independent blocklists have listed it. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain is actively blocked by PhishDestroy, MetaMask, and SEAL. The combination of a recent registration date, use of reputable hosting infrastructure, and the presence of a credential‑phishing page title aligns with a high‑risk profile. The current offline status limits real‑time analysis of the HTTP response body, and no additional payloads or redirection behavior have been captured.

Consequently, the exact phishing kit, any embedded trackers, or the full set of targeted usernames remain unknown. Defenders should continue to enforce domain‑level blocking for latticevaults.net across DNS‑filtering and web‑proxy solutions, monitor for resurgence or re‑hosting on alternative IP ranges, and correlate any outbound authentication attempts from internal users against this indicator. Organizations using services that reference “Lattice” should alert users to the existence of a fraudulent login portal and encourage the use of multi‑factor authentication and password managers that can detect rogue domains.