clerk[.]lat

Analysis of the domain clerk.lat as of August 02, 2026, indicates elevated risk consistent with a targeted phishing campaign. The domain is currently active and has been flagged by PhishDestroy, with three of ninety-one security vendors on VirusTotal detecting malicious activity. It also appears on one security blocklist, suggesting recent identification by threat intelligence feeds. Infrastructure analysis reveals the domain was registered through a privacy-protected registrar, limiting visibility into ownership or hosting provider details.

No associated IP addresses or autonomous system numbers are currently documented in public threat feeds, which may delay broader detection. The specific phishing lure is not yet confirmed, but the domain name aligns with common Microsoft 365 credential harvesting tactics, where attackers mimic authentication portals to capture corporate login credentials. Defenders should treat this domain as an active threat and prioritize blocking at the network perimeter, email gateway, and endpoint levels.

Security teams are advised to review recent authentication logs for connections to clerk.lat, particularly from users who may have interacted with suspicious emails or links. Given the low but growing detection rate, additional monitoring is recommended to assess whether this domain escalates in prevalence or shifts infrastructure. No evidence currently links this domain to a known phishing kit or brand-specific impersonation beyond the Microsoft 365 pattern suggested by the domain name.