kanodex[.]com

This domain, kanodex.com, is an active phishing site targeting social media credentials, first registered on February 21, 2026. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers grannbo.ns.cloudflare.com and jose.ns.cloudflare.com, resolving to IP 172.67.140.206. The site presents a 301 HTTP redirect, suggesting it may forward victims to a credential harvesting page, though the exact destination remains unconfirmed. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites.

Detection coverage is moderate: 14 of 93 security vendors on VirusTotal flag the domain, and it appears on one security blocklist, including PhishDestroy. Google Safe Browsing explicitly classifies it as social engineering. The domain was registered through Web Commerce Communications Limited, a registrar frequently used for both benign and malicious domains. Gridinsoft assigns a trust score of 0/100, indicating high risk.

The page title 'kanodex' provides no clear brand association, and no specific phishing kit or targeted platform (e.g., Facebook, Instagram) is identified in available data. Defenders should treat this domain as a confirmed phishing threat, block access at the network level, and monitor for related domains using the same registrar or hosting infrastructure. Further analysis of the redirect chain and any associated payloads is recommended to determine the full scope of the campaign.