katana138[.]net

PhishDestroy identifies katana138.net as an active credential-harvesting phishing domain currently propagating in the wild. The page is designed to trick users into surrendering login credentials and should be treated as an elevated threat to enterprise and consumer accounts alike. Immediate defensive action is required. This domain was flagged by 12 out of 95 VirusTotal security vendors, indicating broad suspicion across antivirus, reputation, and phishing-intelligence platforms. It resolves to 159.100.22.195 and was registered on March 16, 2024 through NameSilo, LLC. The domain is also covered by multiple public and commercial blocklists and holds a low trust score due to its recent creation and short-lived SSL certificate issued by Let’s Encrypt. Organizations and individuals should block katana138.net at DNS and edge firewalls. Users who may have visited the site should rotate passwords, enable multi-factor authentication, and scan endpoints for follow-on malware or session hijacking. If your SIEM or SOAR ingests blocklists, add this domain immediately as an active indicator of compromise.