2138[.]sn

This domain is flagged as a high-risk generic phishing threat as of July 27, 2026. VirusTotal data shows 11 of 91 security vendors detecting malicious activity, and it appears on one security blocklist. The domain resolves to IP address 103.193.148.167 and is blocked by PhishDestroy. Registration was processed through PlanetHoster Inc, with nameservers ns1.dns.com and ns2.dns.com.

The domain remains active at the time of this assessment. Infrastructure analysis indicates the hosting IP has been associated with other malicious domains, though specific ASN and country data are not available in the current intelligence. The page content has not been analyzed, so the exact phishing lures or brand impersonation, if any, are unknown. Defenders should treat this domain as an active threat, block all traffic to 2138.sn and its associated IP address, and monitor for any related subdomains or new registrations under the same registrar or nameserver pattern.

Given the moderate detection rate, it is possible that the domain is newly active or employs evasion techniques that limit vendor coverage. Organizations should add this domain to their blocklists and investigate any email or web traffic referencing it, as it may be used in credential harvesting or malware distribution campaigns. Periodic re-scanning is recommended to track changes in detection status or hosting infrastructure.