lat[.]sodstreams[.]com

Analysis indicates that lat.sodstreams.com is an active brand-impersonation site targeting Cloudflare. The domain returns HTTP 403 and serves a page titled “Suspected Malware | Cloudflare”. Passive DNS resolves the host to 104.21.73.63. VirusTotal reports 20 of 95 scanned security vendors flag the domain, and it appears on one external blocklist. The domain is currently blocked by PhishDestroy. The high-risk rating reflects its use of a trusted brand name to lure victims, though the exact malicious payload or luring technique has not been observed. Defenders should add the IP address 104.21.73.63 and the FQDN lat.sodstreams.com to deny-list rules, ensure that web-proxy and DNS filtering solutions reference the blocklist that already contains the domain, and monitor network traffic for any connections to the host. Additional investigation is recommended to determine whether the site hosts downloadable malware or credential-harvesting forms, as that detail remains unknown.