aen[.]lat

The domain aen.lat is currently active and identified as a credential theft operation. Analysis indicates the site is designed to harvest user login credentials, likely through fake login portals or deceptive forms. No legitimate brand impersonation has been confirmed, but the infrastructure aligns with common credential harvesting tactics. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 25, 2026, an unusually future-dated registration that may indicate attempts to evade detection. It resolves to the IP address 104.21.19.120 and holds a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and is flagged by 2 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, which does not validate legitimacy but provides encrypted connections often exploited by malicious actors. The domain remains active as of the latest verification. Users are advised to block access to aen.lat at the network level and update endpoint protection rules to include this indicator. Security teams should monitor for connections to 104.21.19.120 and review logs for credential submission attempts originating from this domain. No legitimate traffic is expected from this infrastructure.