kaatana[.]network

This domain, kaatana.network, is identified as a crypto drainer phishing site designed to illicitly extract cryptocurrency from victims. Analysis indicates the domain is currently offline, though prior activity suggests it targeted users through deceptive transaction prompts or wallet connection requests. No specific brand impersonation has been confirmed, but the infrastructure aligns with known crypto-theft operations. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusual future date that may indicate falsified registration details. It resolved to the IP address 188.114.96.3 and was flagged by 10 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and has been included in eight threat intelligence pulses on AlienVault OTX. Additional technical indicators include the use of a Let’s Encrypt SSL certificate, Cloudflare for content delivery, and HTTP/3 protocol support. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as high-risk. The domain is currently offline, likely due to takedown efforts or infrastructure adjustments by the threat actor. However, given the elevated risk and historical activity, organizations and users are advised to block all connections to kaatana.network at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. If wallet addresses or transaction hashes associated with this domain are identified, they should be added to internal blocklists to prevent financial loss. Proactive threat hunting for indicators of compromise linked to this infrastructure is recommended.