hodlcoin[.]lat

Analysis of hodlcoin.lat indicates a generic phishing domain targeting cryptocurrency users, currently offline as of July 22, 2026. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (AS13335), resolving to IP 188.114.97.3. Nameservers liv.ns.cloudflare.com and michael.ns.cloudflare.com further confirm Cloudflare as the DNS provider. No SSL certificate is present, increasing exposure to interception risks.

The page title 'Nur einen Moment…' suggests a temporary holding or redirect page, though the exact content and phishing mechanics remain unconfirmed due to the domain's offline status. Security vendors have flagged hodlcoin.lat on three blocklists, including PhishDestroy, MetaMask, and SEAL, with VirusTotal reporting detections from 3 of 93 vendors. While the low detection count does not imply safety, the domain's inclusion on multiple specialized blocklists indicates targeted recognition of its threat profile. The absence of an SSL certificate and the use of Cloudflare—common among both legitimate and malicious sites—do not alone confirm malicious intent but align with observed patterns in phishing infrastructure.

Defenders should treat this domain as a confirmed phishing threat based on blocklist inclusion and registrar history. Network-level blocking of 188.114.97.3 and monitoring for related domains under the same registrar or nameservers is recommended. Given the domain's offline status, further forensic analysis may be limited, but historical DNS records and passive DNS data could reveal additional infrastructure linkages. No brand-specific targeting is evident from the available data, and the exact phishing vector (e.g., wallet drainer, credential theft) remains unclassified.