latairfinder[.]com

The domain latairfinder.com has been identified as an active generic phishing threat, currently under investigation. Analysis indicates that the website is impersonating LATAM Airlines, specifically targeting users by mimicking LATAM Pass Platinum Benefits pages. The site remains operational and poses a risk of credential harvesting through brand impersonation tactics.

Technical analysis reveals the following: latairfinder.com was registered on June 22, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to IP address 172.67.142.82. As of this report, VirusTotal shows 0 out of 95 vendors have flagged this domain, indicating it is not yet widely detected or blocked by major threat intelligence platforms. However, AlienVault OTX has included this domain in 1 threat intelligence pulse, suggesting initial recognition within security research communities. The page title, "LATAM Airlines Privilege Program | LATAM Pass Platinum Benefits," underscores the intent to deceive users seeking legitimate airline benefits.

Given that the domain is still active and not yet flagged by mainstream blocklists, it represents a heightened risk for potential victims who may submit sensitive information under the false pretense of a trusted airline loyalty program. It is recommended to block latairfinder.com at the network perimeter, monitor for user access attempts, and educate end-users about the risk of credential phishing from domains registered recently, particularly those impersonating established brands. Continued monitoring for emerging detection and threat intelligence updates is advised.