latestreuters[.]com

This domain, latestreuters.com, is identified as a high-risk credential harvesting phishing site designed to impersonate the legitimate Reuters news platform. Analysis indicates the domain employs generic phishing tactics, likely leveraging cloned login portals or fake subscription prompts to harvest user credentials. No specific drainer kit signatures have been confirmed, though the infrastructure aligns with broad-scale phishing campaigns targeting media consumers and corporate users. Infrastructure analysis reveals the domain was registered through OwnRegistrar, Inc. on May 25, 2026, with a Let's Encrypt SSL certificate (serial E7) providing HTTPS encryption. The domain resolves to IP address 172.67.136.241 and is currently flagged by 15 out of 95 security vendors on VirusTotal. It appears on three distinct security blocklists and is actively blocked by enterprise phishing detection systems and cryptocurrency wallet security layers. The creation date suggests either a typo-squatting attempt or a pre-registered domain intended for future malicious use. As of the latest assessment, latestreuters.com has been taken offline, reducing immediate exposure. However, residual risk remains due to potential DNS caching, phishing emails still in circulation, or secondary domains linked to the same threat actor. Organizations are advised to update blocklists with the domain and IP, monitor for related indicators, and alert users who may have interacted with the site prior to its deactivation. SSL certificate transparency logs should be reviewed for additional malicious domains using the same certificate authority.