otkatanet[.]net

Analysis of otkatanet.net shows a high‑risk, active phishing operation. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., with the site served over HTTPS using a Google Trust Services / WE1 certificate. The web stack is identified as WordPress powered by MySQL, PHP, Bootstrap, Yoast SEO, Underscore.js, Slick and prettyPhoto, consistent with a typical content‑management deployment. The front‑page title, "Купить стероиды для роста мышц – цены на анаболики (фарму) с доставкой по России," indicates the site is advertising anabolic steroids for Russian customers, a common lure in phishing kits. HTTP requests return status 200, and the domain appears on a single security blocklist, with PhishDestroy explicitly listing it as malicious. VirusTotal scans report two detections out of 93 scanning engines, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 / 100, and the Cloudflare‑based DNS configuration (eloise.ns.cloudflare.com, norm.ns.cloudflare.com) further obscures the origin infrastructure. While the exact phishing payload or credential‑capture mechanism has not been observed, the combination of a suspicious commercial title, low trust scores, blocklist inclusion, and multi‑engine detections warrants immediate remediation. Defenders should block the domain at the DNS and proxy layers, monitor for outbound connections to the associated IP address, and consider adding the domain to internal blacklists. Ongoing intelligence collection should focus on any associated command‑and‑control endpoints or credential‑harvesting forms that may be hosted behind the same infrastructure.