97ee8[.]catex[.]at

Analysis as of July 21 2026 indicates that the domain 97ee8.catex.at is actively used for generic phishing. The domain is registered with DNSpod and uses the authoritative nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com. DNS resolution returns the single IPv4 address 31.59.121.53, which remains reachable at the time of analysis. The domain has been added to the PhishDestroy blocklist and is listed on one additional security blocklist, confirming that at least two independent threat‑intelligence feeds consider it malicious.

VirusTotal has recorded 18 detections out of 95 scanned security vendors, demonstrating a moderate consensus among anti‑malware engines that the domain hosts malicious content. No public page title, SSL certificate details, or HTTP response codes have been disclosed, so the exact nature of the hosted page cannot be verified beyond the phishing classification present in the threat feed. The infrastructure appears to be static; no evidence of rapid IP changes or CDN usage was observed.

Defenders should add 97ee8.catex.at and its resolved IP 31.59.121.53 to outbound and inbound deny lists, monitor DNS queries for the three DNSpod nameservers, and continue to reference the PhishDestroy feed for updates. Because the domain is still marked as active, continued observation is recommended to detect any shifts in hosting or additional payload delivery. Organizations that rely on brand‑specific email authentication should also consider tightening DMARC policies to mitigate credential harvesting attempts that may reference this domain.