program-katana[.]xyz

This domain, program-katana.xyz, is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate authentication portals, likely aiming to capture sensitive credentials such as usernames, passwords, and multi-factor authentication tokens. The domain employs social engineering tactics to induce urgency or trust, a common characteristic of credential-focused phishing campaigns. Infrastructure analysis reveals the domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.97.3, hosted on AS13335 Cloudflare, Inc., a network often leveraged to obfuscate origin servers. As of the latest assessment, the domain is detected by 4 out of 95 security vendors on VirusTotal and appears on 3 distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections, further legitimizing the site to unsuspecting users. Users who have visited program-katana.xyz or interacted with its content should immediately take remedial actions. Credentials entered on the site should be considered compromised and must be reset across all platforms where identical or similar passwords were used. Multi-factor authentication should be enabled or updated to mitigate unauthorized access. Network-level blocking of the domain and its associated IP (188.114.97.3) is recommended for enterprise environments. Monitoring for unusual account activity, particularly logins from unfamiliar locations or devices, is advised for at least 30 days post-exposure.