katei[.]ddns[.]net

Katei.ddns.net is currently active and resolves to 5.48.198.182, an IP owned by AS5410 Bouygues Telecom SA in France. The domain is hosted on No‑IP dynamic DNS infrastructure, using nameservers nf1.no‑ip.com., nf2.no‑ip.com., nf3.no‑ip.com., and nf4.no‑ip.com. An SSL certificate issued by Let’s Encrypt (R12) is present, indicating HTTPS support. The web server is Nginx delivering a React application that includes the Didomi consent‑management library. The HTTP response returns status 200 with the page title “Free”, but the page content has not been publicly analyzed. The domain appears on two phishing blocklists (PhishDestroy and PhishingDB) and received a Gridinsoft trust score of 0/100. VirusTotal scans show 19 of 93 security vendors flag the host, reinforcing the malicious assessment. Given the high‑risk classification, defenders should add katei.ddns.net to URL filtering and endpoint block lists, monitor outbound connections to its IP address, and enforce TLS inspection to detect any credential‑harvesting activity. Continuous re‑evaluation is recommended as threat actors may modify payloads or host additional phishing pages on the same infrastructure.