testnet[.]lora-finance[.]lat

The domain testnet.lora-finance.lat is currently classified as a high‑risk generic phishing site. The infrastructure was first observed on March 13, 2026, and remains active as of July 12, 2026. The site presents a page titled “Lora Finance | Testenet”, which is consistent with the branding of a legitimate financial service, suggesting an attempt to lure victims into credential harvesting.

Technical analysis shows the domain resolves to the IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) and located in the United States. The authoritative nameservers are amos.ns.cloudflare.com and maya.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The web server presents a valid Let's Encrypt certificate (issued to E8) and negotiates HTTP/3, confirming modern TLS configuration. Front‑end technologies identified include Bootstrap and Cloudflare Browser Insights, typical of rapidly assembled phishing pages.

The site returns HTTP status 200, confirming that the page is publicly reachable. It has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal analysis reports that 2 of 95 scanned security vendors have flagged the domain, providing independent corroboration of malicious intent. Registration information lists the registrar as PDR Ltd. d/b/a PublicDomainRegistry.com, a provider commonly used for disposable or low‑cost domains.

Defenders should immediately block testnet.lora-finance.lat at the DNS and proxy layers to prevent end‑user exposure. Continuous monitoring of Cloudflare‑served IP ranges for similar activity is advised, as the attacker may shift to adjacent addresses. Organizations that use the Lora Finance brand should educate users about the bogus “Testenet” variant and deploy URL filtering rules that reference this exact domain. Incident response teams should collect HTTP request logs and any credential submissions for further forensic analysis.