777[.]lat

This domain, 777.lat, is identified as a fake login phishing portal designed to harvest user credentials through deceptive login interfaces. Analysis indicates the site is currently offline, though it remains a documented threat in security databases. The domain was actively used to impersonate legitimate login pages, likely targeting users of financial, social media, or corporate platforms, though no specific brand impersonation has been confirmed in this instance. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 38.180.187.190. It is flagged by 5 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and employs technologies including WordPress, MySQL, PHP, and Cloudflare Browser Insights. A Let’s Encrypt SSL certificate was used to create a false sense of security, while detected components such as jQuery Migrate and All in One SEO suggest an attempt to mimic legitimate web infrastructure. Current status indicates the domain has been taken offline, though historical data and residual risk remain. Organizations and individuals are advised to block the domain and its associated IP at the network level. Security teams should review logs for connections to 38.180.187.190 or 777.lat between February 2026 and the takedown date. Users who may have interacted with the site should reset credentials for any accounts accessed during that period, particularly if login attempts were made. Monitoring for similar domains registered via NameCheap with identical infrastructure patterns is recommended for proactive threat detection.