onsingcoin[.]lat

Analysis of the domain onsingcoin.lat indicates that it was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline. The authoritative name servers are liv.ns.cloudflare.com and michael.ns.cloudflare.com, confirming that the domain is fronted by Cloudflare’s network. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served over HTTPS using a Let’s Encrypt certificate (E7) and employed HTTP/3, a modern transport protocol, suggesting a recent deployment.

The page title returned by the server is "Just a moment...", a generic placeholder often seen on Cloudflare‑protected sites, but no further content has been captured. Security‑vendor scanning on VirusTotal reported that 2 of 95 scanners flagged the domain, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. Independent trust scoring by Gridinsoft assigned a zero‑point rating out of a hundred, indicating extreme suspicion.

While the available data confirms phishing‑related categorisation and elevated risk, the exact payload, targeted brands, or credential‑harvesting mechanisms remain unknown because the site is offline and no additional content has been observed. Defenders should continue to block the domain at perimeter filters, enforce DNS sink‑hole rules for the associated IP and name servers, and monitor for any re‑appearance of the domain or related infrastructure. Given the low trust score, presence on multiple blocklists, and partial vendor detections, the domain should be treated as a high‑confidence phishing indicator until further evidence emerges.