kodiakfinance-kodiak-finance[.]org

Analysis of the domain kodiakfinance-kodiak-finance.org indicates that it was registered on 30 May 2025 through NiceNIC International Group Co., Limited and is currently taken offline. The authoritative nameservers diana.ns.cloudflare.com and eoin.ns.cloudflare.com resolve the domain to the IP address 172.67.175.53, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL/TLS certificate is associated with the host, meaning connections are unencrypted. VirusTotal reports that 17 of 95 security vendors have flagged the domain, confirming a consensus of malicious classification.

The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of trust. AlienVault OTX references the domain in one threat‑intel pulse, further corroborating its malicious use. The available intelligence points to a generic phishing operation, though no additional content analysis (page title, brand impersonation, or phishing kit) has been published.

Defenders should immediately add kodiakfinance-kodiak-finance.org and its resolving IP 172.67.175.53 to denylists and firewall rules, ensure DNS filtering solutions block the domain, and monitor Cloudflare‑hosted traffic for any resurgence. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is recommended to capture any future changes in detection rates. Organizations using DNS‑based threat feeds should verify that the domain is present in their blocklists and, if not, manually ingest the indicator to mitigate exposure to the ongoing phishing campaign.