sitefullapp[.]lat

This report details the technical analysis of sitefullapp.lat, a domain identified as an impersonation threat. The site was configured to impersonate the Guatemalan bank BANTRAB, as evidenced by its page title, "Bantrab en Línea — Personas". This constitutes a brand impersonation scam, designed to deceive users into believing they are accessing the legitimate BANTRAB online banking portal. The primary threat is credential theft and financial fraud, as victims may enter sensitive login information on the fraudulent site.

Technical analysis reveals the domain was created on 2025-10-30 via registrar Spaceship, Inc. It is hosted on IP address 138.128.241.86, located in the United States, and associated with AS36037 (Kamatera, Inc.). The domain uses nameservers launch1.spaceship.net and launch2.spaceship.net. It lacks an SSL certificate, indicating no encrypted connection. VirusTotal scans show 7 out of 95 security vendors flagged the domain as malicious, with detections from alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, Seclookup, and SOCRadar. The domain appears on one blocklist. GridinSoft assigns a trust rating of 0 out of 100.

As of the analysis, the domain is reported as DOWN/OFFLINE, suggesting the threat is currently inactive. However, given its recent creation and high detection rate, the risk level remains high if the site becomes active again. The domain may be revived with a similar fraudulent scheme.