shroomates[.]lat

This domain, shroomates.lat, is currently flagged as an active phishing threat with high-risk classification. Registered on March 11, 2026, through a domain registrar known for low-cost registrations, the domain resolves to 172.67.154.219, an address associated with Cloudflare's network (AS13335). The infrastructure is further confirmed by nameserver records pointing to Cloudflare's DNS servers, which is consistent with threat actors leveraging content delivery networks to obscure hosting origins and evade detection. Analysis of the domain's current state reveals a 403 HTTP status, indicating access restrictions or a placeholder page, while the page title 'Just a moment...' suggests the use of Cloudflare's interstitial page or a temporary hold. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate the legitimacy of the site. Security vendor detections remain limited, with only one of ninety-five vendors on a major scanning platform flagging the domain as malicious, though it appears on three security blocklists and has been documented in at least one threat intelligence feed. The scam type is classified as generic phishing, though specific targeting or impersonated brands remain unconfirmed. The domain's registration age, combined with its presence on multiple blocklists and its Cloudflare-hosted infrastructure, aligns with common phishing domain characteristics. Defenders should treat this domain as an active threat, particularly given its inclusion in reputable blocklists and its use of evasion techniques such as CDN masking. Network-level blocking or monitoring of connections to 172.67.154.219 and associated domains is recommended until further evidence of takedown or remediation is observed.