slurmit[.]lat

Analysis of slurmit.lat, first observed on February 27 2026, shows a domain registered through PDR Ltd. d/b/a PublicDomainRegistry.com and hosted on Cloudflare’s network (AS13335) with the address 172.67.139.213. The site currently resolves to that IP but has been taken offline at the time of this assessment (July 24 2026). No SSL certificate is presented, and HTTP responses return the generic page title “Just a moment…”, which is typical of services that pause before redirecting or loading additional content. VirusTotal records indicate that one of ninety‑three security vendors flagged the domain, suggesting at least a single detection of malicious behavior.

Independent blocklists confirm the domain’s presence on three separate security lists, and it is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. The Gridinsoft trust score of zero out of one hundred further reinforces the hostile assessment. The available evidence points to a generic phishing operation, although the specific payload or credential‑harvesting technique has not been disclosed. The lack of an SSL certificate, combined with the generic title and the fact that the domain is hosted behind Cloudflare, is consistent with temporary phishing infrastructure that relies on rapid provisioning and takedown.

Defenders should continue to block the domain at the network perimeter, update intrusion‑detection signatures with the observed IP and domain, and monitor for any re‑appearance under different subdomains or on the same Cloudflare edge IP range. Because the site is offline, real‑time verification of its content is not possible; further research should be directed at any archived snapshots or telemetry that may reveal the exact phishing landing page. Until additional indicators emerge, the domain should be treated as a confirmed malicious resource and remain on deny lists.