ollana[.]net

This domain, ollana.net, is currently under investigation for distributing counterfeit Windows installation packages under the guise of the Ollama software distribution. Analysis indicates the site specifically targets users seeking to download Ollama on Windows platforms, presenting itself as an official download source. The threat type is classified as generic phishing with brand impersonation, designed to deceive users into executing malicious payloads. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in phishing operations. The domain resolves to the IP address 104.21.86.78, which is hosted on a content delivery network known for obfuscating attacker infrastructure. As of the latest assessment, the domain has not been flagged by any of the 95 security vendors on VirusTotal, though it appears in one threat intelligence pulse on AlienVault OTX. The page title, 'Download Ollama on Windows,' directly mimics legitimate software distribution pages, increasing the likelihood of user deception. The domain remains active and unblocked across major security platforms, posing an ongoing risk to end users. Organizations are advised to implement network-level blocking for the domain ollana.net and its associated IP address 104.21.86.78. Endpoint protection systems should be updated to detect and prevent execution of files downloaded from this source. Users who may have interacted with the site should perform a full system scan and reset credentials for any accounts accessed on potentially compromised devices. Continuous monitoring for related infrastructure is recommended, as the threat actor may pivot to new domains or IPs.