allocation-katana[.]network

This domain, allocation-katana.network, is currently flagged as an active phishing threat targeting cryptocurrency users. Registered on May 9, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to 104.21.31.193, an IP address hosted by Cloudflare in Canada. Analysis indicates the site is configured to return an HTTP 403 status, suggesting either a cloaking mechanism to evade detection or a temporary misconfiguration. The nameservers damon.ns.cloudflare.com and maya.ns.cloudflare.com further confirm the use of Cloudflare infrastructure, a common tactic among phishing operators to obscure hosting origins and leverage the provider's SSL certificates for legitimacy. Security vendors have detected malicious activity associated with allocation-katana.network, with 3 out of 95 engines on VirusTotal flagging the domain as phishing-related. Additionally, the domain appears on one security blocklist and has been documented in a single threat intelligence pulse on AlienVault OTX, reinforcing its classification as a high-risk threat. The Gridinsoft trust score of 0/100 further corroborates the domain's malicious intent. The SSL certificate, issued by Let's Encrypt, is consistent with phishing campaigns that aim to appear secure while harvesting credentials. While the specific phishing kit or targeted brand remains unconfirmed, the domain name suggests an attempt to impersonate cryptocurrency wallet services, a common tactic in financial phishing schemes. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. Organizations are advised to monitor for connections to 104.21.31.193 and review logs for any interactions with allocation-katana.network, particularly from endpoints handling cryptocurrency transactions. Given the domain's recent registration and low detection counts, continued vigilance is warranted as the campaign may still be evolving.