gorkcoin[.]lat

Analysis of the domain gorkcoin.lat indicates it was actively flagged as part of a cryptocurrency phishing operation before being taken offline on or before July 24, 2026. The domain was registered on February 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and was hosted behind Cloudflare nameservers (audrey.ns.cloudflare.com and rohin.ns.cloudflare.com), resolving to the IP address 172.67.202.159, which is part of AS13335 (Cloudflare, Inc.) in the United States. At the time of assessment, no SSL certificate was detected, increasing the likelihood of unencrypted credential interception. The domain appeared on three security blocklists and was explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting targeted detection by cryptocurrency security tools. VirusTotal recorded a single detection from one of 93 security vendors, though this limited visibility does not rule out broader malicious intent.

The page title 'Just a moment...' is consistent with Cloudflare challenge pages or placeholder content, which may indicate either an incomplete setup or deliberate obfuscation of the phishing landing page. Infrastructure analysis reveals the use of Cloudflare, a common tactic to conceal hosting origins and evade IP-based blocking. The absence of an SSL certificate further aligns with low-effort or rapidly deployed phishing infrastructure. While the exact content of the site remains unanalyzed, the combination of cryptocurrency-focused blocklisting, Cloudflare proxying, and recent registration strongly suggests this domain was intended to deceive users into disclosing wallet credentials or transferring digital assets.

Defenders should treat this domain as confirmed malicious and maintain its blocklisting status. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure. If internal logs indicate user interaction with gorkcoin.