airigcomplex[.]lat

Analysis of the domain airigcomplex.lat shows a newly registered internet resource created on March 11, 2026 and hosted behind Cloudflare’s edge network (AS13335). The domain resolves to IP 104.21.89.170, which is owned by Cloudflare, Inc., and uses a Let's Encrypt E7 certificate that provides TLS encryption without revealing the origin server. Cloudflare Browser Insights and HTTP/3 indicate modern delivery mechanisms, while the authoritative nameservers are amos.ns.cloudflare.com and maya.ns.cloudflare.com. The site returns an HTTP 403 status and displays a page title of "Just a moment...", suggesting that direct content retrieval is intentionally blocked.

Threat intelligence flags airigcomplex.lat as a high‑risk generic phishing vector. Only one of ninety‑five security vendors on VirusTotal has raised a detection, but the domain receives a Gridinsoft trust score of 0 out of 100, and it appears on three external blocklists. It is listed in a single AlienVault OTX pulse and has been explicitly blocked by three independent protection services (PhishDestroy, MetaMask, and SEAL). The combination of a low trust score, blocklist presence, and active blocking by security products aligns with the classification of a generic phishing operation targeting unsuspecting users.

While the available data confirms the domain’s infrastructure and its detection by multiple security entities, the precise phishing payload, target audience, and any malicious infrastructure beyond the Cloudflare front‑end remain unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any new indicators of compromise that reference the 104.21.89.170 address, and update detection rules to include the observed page title and HTTP 403 response pattern. Ongoing observation of VirusTotal submissions and blocklist updates is recommended to capture any escalation in malicious activity originating from this domain.