308[.]lat

Analysis of www.308.lat, created on July 20, 2026, shows it is currently active and resolves to the IPv4 address 192.178.183.121. The domain is registered through DYNADOT LLC and uses the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. On VirusTotal the domain was examined by 91 scanning vendors; at the time of review no detections were reported, though the absence of detections does not constitute a safety assurance.

The domain appears on one external security blocklist and has been blocked by the PhishDestroy sinkhole, indicating that at least one threat‑matching engine has identified it as a phishing vector. No public SSL certificate details, HTTP response codes, page titles, or content snapshots are available in the current intelligence feed, so the exact landing page behavior and any credential‑harvesting mechanisms remain unverified. The limited data set therefore leaves the specific tactics employed by the site uncertain, but the registration timeline, hosting information, and blocklist presence collectively support the classification as a generic phishing infrastructure.

Defenders should consider adding the domain and its IP address to outbound filtering rules, update DNS sinkhole configurations to drop queries for the domain, and monitor DNS logs for any resolution attempts. Continuous re‑scanning on multi‑vendor platforms such as VirusTotal is recommended to capture any future changes in detection status, and threat‑intel feeds should be polled for additional indicators that may emerge as the campaign evolves.