latticetradex[.]com

Analysis of the domain latticetradex.com indicates it was operating as a credential phishing site, as evidenced by its page title 'Lattice Structure|Login' and classification by multiple security vendors. The domain was registered on March 6, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the site was hosted behind Cloudflare (AS13335), resolving to the IP address 104.21.18.252, with nameservers christina.ns.cloudflare.com and jeff.ns.cloudflare.com. The SSL certificate was issued by Google Trust Services (WE1), a common configuration for phishing sites leveraging legitimate certificate authorities to appear trustworthy.

As of the report date, the domain is offline, though its prior activity is confirmed by its presence on three security blocklists and blocking actions taken by PhishDestroy, MetaMask, and SEAL. The absence of detections in VirusTotal scans—conducted by 94 vendors—does not confirm safety, as phishing domains often evade initial detection or are flagged only after takedown. The scam type is explicitly categorized as credential phishing, though the exact target (e.g., corporate HR platforms, cryptocurrency services, or other lattice-themed applications) remains unverified due to limited page content analysis. Defenders should treat this domain as malicious based on its registration patterns, hosting infrastructure, and confirmed blocking by security vendors.

Network-level blocks should be implemented for 104.21.18.252 and associated Cloudflare ranges, while email and web gateways should flag any references to latticetradex.com. Given the domain's use of Cloudflare, historical DNS records and certificate transparency logs may provide additional indicators for retrospective hunting. Further investigation into the registrar's role in facilitating this campaign is recommended, particularly given Gname.com Pte. Ltd.'s history with similar threats.