kodiakfinance[.]net

The domain kodiakfinance.net has been identified as a phishing domain with an elevated risk level, specifically targeting credential theft. The domain does not appear to be associated with any specific brand or crypto drainer kit, but its infrastructure and behavior suggest it was used to trick users into revealing sensitive information such as usernames and passwords.

Analysis indicates that the domain has a VirusTotal score of 16/95, with 16 security vendors flagging it as malicious. The domain is registered through Web Commerce Communications Limited and resolves to the IP address 178.16.53.184, which is located in the Netherlands and is part of the AS202412 Omegatech LTD network. The domain was created on April 11, 2025, and its SSL certificate is issued by Let's Encrypt / R12. The domain appears on 2 security blocklists, including PhishDestroy and PhishingDB, and is currently marked as offline in the Google Safe Browsing (GSB) database.

The current status of kodiakfinance.net is offline, suggesting that it has been taken down. However, the infrastructure used to support the domain, including the IP address and registrar, may still pose a risk if reused in future campaigns. Security professionals and users are advised to remain vigilant and avoid interacting with any links or emails that reference this domain. Additional monitoring and filtering mechanisms should be implemented to prevent any residual threats from affecting network security.