gork[.]websites[.]lat

This domain, gork.websites.lat, is an active phishing infrastructure currently resolving to 188.114.96.3 (AS13335, Cloudflare, Inc.) in the United States. Registered on March 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain exhibits characteristics consistent with phishing operations, including a 403 HTTP status and a placeholder page title 'Just a moment...'—a common indicator of Cloudflare-protected phishing sites awaiting activation or evading detection. The domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100, reinforcing its high-risk classification. SSL certification is provided by Let's Encrypt (E8), and the site employs Cloudflare Browser Insights alongside HTTP/3, suggesting an attempt to blend with legitimate traffic while maintaining operational security. Infrastructure analysis reveals reliance on Cloudflare nameservers (amos.ns.cloudflare.com, maya.ns.cloudflare.com), which may complicate takedown efforts or attribution. While one of 94 security vendors on VirusTotal flags the domain, this detection rate alone does not confirm the specific phishing payload or target. No brand, scam type, or kit details are currently associated with the domain, and the exact content remains unanalyzed. Defenders should treat this domain as high-risk, particularly given its Cloudflare hosting and recent registration. Recommended actions include blocking resolution at the DNS level, monitoring for changes in HTTP status or page content, and correlating with other indicators if additional context (e.g., phishing emails, associated IPs) emerges. The domain's continued activity as of July 12, 2026, warrants ongoing scrutiny.