app-katana[.]world

The domain app-katana.world has been identified as a crypto wallet drainer phishing operation targeting users of decentralized finance platforms. This domain is currently offline but was previously active in deploying malicious smart contract interactions designed to siphon cryptocurrency assets from victim wallets. Analysis indicates the infrastructure was specifically engineered to exploit transaction signing processes, a common tactic in wallet drainer schemes. Infrastructure analysis reveals the domain was registered on March 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 104.21.74.119, hosted behind Cloudflare's network in Canada, a configuration frequently observed in phishing campaigns to obscure origin servers. The domain was flagged by 11 of 95 security vendors on VirusTotal and appears on four distinct security blocklists. The SSL certificate was issued by Let's Encrypt (serial number E8), a legitimate provider often abused by threat actors to lend credibility to malicious sites. Detection engines including PhishDestroy, MetaMask's threat intelligence, ScamSniffer, and SEAL all classified this domain as malicious, with a consensus risk rating of high. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active period. Organizations and individuals are advised to implement the following mitigations: block the domain and associated IP at network perimeter controls, revoke any wallet permissions granted to unknown contracts, and monitor transaction histories for unauthorized activity. Security teams should treat any prior connections to this domain as potential compromise indicators and conduct forensic analysis on affected systems. Given the domain's registration recency and use of bulletproof infrastructure, vigilance for similar patterns (e.g., newly registered domains with Cloudflare proxies) is recommended for proactive threat hunting.