tapir329wrf[.]lat

This domain is flagged as a credential harvesting phishing site targeting users of online entertainment platforms. The page title, Tapir329 Situs Hiburan Online Dengan Bonus Harian Menarik, suggests an attempt to lure victims with promises of daily bonuses, a common tactic to collect login credentials, payment details, or personal information under false pretenses. Analysis indicates the site is designed to mimic legitimate gaming or gambling portals, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain was registered on May 27, 2026, through NAMECHEAP INC, an often-abused registrar for malicious operations. It resolves to IP address 104.21.70.104, hosted on AS13335 Cloudflare, Inc., a network frequently leveraged to obscure origin servers. Detection metrics show 1/95 security vendors on VirusTotal flagging the domain, while it appears on three independent security blocklists. The SSL certificate, issued by Let's Encrypt (serial E7), provides encrypted connections but does not validate legitimacy, a common characteristic of phishing infrastructure. Users who have visited tapir329wrf.lat should immediately revoke any entered credentials, particularly for financial or entertainment accounts. Monitor linked accounts for unauthorized transactions or changes. If payment details were submitted, contact financial institutions to flag potential fraud. Clear browser cache and cookies to remove tracking artifacts. Network administrators should block the domain and associated IP (104.21.70.104) at the perimeter. Report the domain to internal security teams for further investigation and correlation with other indicators of compromise.