kenaikoda[.]com

The domain kenaikoda.com has been identified as a brand impersonation threat specifically targeting Zoom, a widely recognized video conferencing platform. Analysis confirms the domain was actively impersonating Zoom’s branding, as evidenced by the page title 'One platform to connect | Zoom.' The domain is currently offline, though prior activity suggests malicious intent to deceive users into believing they were accessing legitimate Zoom services.

Technical indicators reveal the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating moderate to elevated detection rates. It was registered through NameCheap, Inc., on December 03, 2025, and resolved to the IP address 170.114.78.80. The domain appears on two security blocklists, including PhishDestroy and Maltrail, and has a Gridinsoft trust score of 0/100. Infrastructure analysis further detects the use of technologies such as Optimizely, OneTrust, HSTS, Google Tag Manager, DigiCert, Cloudflare, and HTTP/3, which may have been employed to mimic legitimate service infrastructure or evade detection.

Current status confirms the domain has been taken offline, reducing immediate risk to end users. However, organizations and individuals are advised to proactively block the domain and its associated IP address (170.114.78.80) at the network level to prevent potential future reactivation. Security teams should monitor for similar impersonation attempts, particularly those leveraging Zoom’s branding, and educate users on verifying domain authenticity before entering credentials or sensitive information. Additionally, reviewing logs for connections to 170.114.78.80 or related domains registered via NameCheap during the period of activity (December 2025 onward) is recommended for comprehensive threat mitigation.