disanati[.]com

This domain, disanati.com, is identified as a fake login page specifically designed to impersonate Disnat, a legitimate financial services platform. Analysis indicates the site was operational as a credential harvesting portal targeting users of the Disnat brand. The page title explicitly mimics the authentic Disnat login interface, reinforcing the impersonation attempt. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, registered through Hello Internet Corp on February 02, 2026, and resolved to the IP address 124.198.131.119. The IP is geolocated in the United States under AS210558 (1337 Services GmbH). The domain appears on one security blocklist, and its SSL certificate is classified as E7, indicating potential misconfiguration or malicious intent. The creation date suggests the domain was recently established for malicious purposes, aligning with typical phishing campaign timelines. As of the latest verification, disanati.com has been taken offline. However, the infrastructure may remain dormant or be repurposed for future attacks. Organizations and users are advised to block the domain and associated IP at the network level, monitor for residual DNS queries, and educate users on recognizing brand impersonation tactics. Security teams should review logs for prior interactions with this domain and investigate any credential submissions or redirects to the IP address 124.198.131.119.