snapshot[.]lat

snapshot.lat was registered on November 21 2025 through Dynadot LLC and resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network. The domain is served by Cloudflare’s infrastructure, using the nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com and supporting HTTP/3. An HTTP 301 redirect delivers a page titled “Access denied | snapshot.lat used Cloudflare to restrict access | snapshot.lat”.

The domain has a Gridinsoft trust score of 0 / 100 and appears on at least one public blocklist. It has been flagged by PhishDestroy and five of ninety‑five VirusTotal scanners have raised warnings. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming a valid TLS connection despite the malicious reputation.

Threat intelligence classifies snapshot.lat as a generic phishing site with a high risk rating and an active status. The “Access denied” page suggests the site is intentionally restricting direct access, a pattern often used to hide malicious payloads behind redirects or to evade automated crawling. No further content has been captured, so the exact phishing lure, credential‑stealing pages, or data‑collection mechanisms remain unverified.

Defenders should add snapshot.lat and its resolving IP 188.114.96.3 to outbound and inbound block lists, enforce DNS sinkholing, and monitor for any new CNAME or A‑record changes. Continuous re‑scanning with multi‑engine services is advised to detect any evolution of the payload. Logging of TLS handshakes to the domain can provide early indicators of attempted connections, allowing rapid containment.