everest[.]lat

This domain, everest.lat, is flagged as an active phishing threat as of July 12, 2026. Analysis indicates it was registered on March 11, 2026, through a registrar commonly associated with high-risk domains. The site currently resolves to 172.67.192.210, an IP address hosted on Cloudflare's network (AS13335), which is frequently leveraged to obscure malicious infrastructure. The domain returns an HTTP 403 status, suggesting access restrictions or a placeholder page, while the visible page title 'Just a moment...' aligns with behavior seen in phishing kits that employ Cloudflare protections to delay or filter requests. Infrastructure analysis reveals the use of Cloudflare nameservers (amos.ns.cloudflare.com and maya.ns.cloudflare.com) and technologies such as Cloudflare Browser Insights and HTTP/3, which are consistent with modern phishing campaigns aiming to evade detection. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate the legitimacy of the site. Security vendors have begun flagging this domain, with one out of 95 engines on VirusTotal identifying it as malicious, and it appears on three security blocklists, including PhishDestroy and MetaMask's threat feeds. The domain's classification as 'generic phishing' suggests it may be designed to harvest login credentials, payment details, or other sensitive information, though the specific target or brand impersonation remains unclear. The lack of visible content or redirect behavior at the time of analysis limits further attribution. Defenders should treat this domain as high-risk and consider blocking it at the network level, particularly in environments where credential theft or financial fraud poses a significant threat. Monitoring for changes in behavior, such as new redirects or content updates, is recommended to assess evolving tactics.