Koi’s Note, February 12, 2026: “Appeared in Code Analyzed” and “No Evidence … Connected.”

In a note dated February 12, 2026, Koi wrote that meetingtv[.]us “appeared in code analyzed during our investigation” but that it found “no evidence that this domain is connected or related in any way” to the infrastructure or the threat actor group its post describes. MeetingTV Inc. sued Koi Security Inc. in the Southern District of California (No. 3:26-cv-01705), and the brief of two defendants argues that the report’s analysis is “protected opinion, not actionable falsehood.” As of October 2, 2026, the public docket showed no ruling on the motion.

According to emails MeetingTV filed with its complaint, a DNSFilter ticket submitted under its CEO’s name at 16:05 EST on February 4, 2026 reported meetingtv[.]us under the issue type “Suspected False Positive,” with notes reading “We are a reputable search engine for free and public webinars” and “We demand you remove these false statements.” According to those emails in MeetingTV’s complaint, the ticket’s form listed three “current categories”: “Malicious Lite(79), Malware(66), Suspicious & Deceptive(83).”

At 17:34 EST, according to emails MeetingTV attached to its complaint, the DNSFilter support reply on ticket 229638 read “Hi,” then “See here:”, two links, one to Koi’s post and one to a VirusTotal page for the domain, then: “Our categories simply reflect public data.” MeetingTV alleges DNSFilter “expressly cited the Koi Report as the basis for its decision and refused to delist Plaintiff.” The brief of two defendants says the complaint “does not allege that any Defendant requested, instructed, or directed any vendor to block, flag, or take any action against MeetingTV’s domains.”

The rest of the thread MeetingTV filed, February 9 to February 11, 2026.

According to emails MeetingTV filed with its complaint, an automated message dated February 9, 2026 said the ticket would close “in the next few days” if DNSFilter did not hear back, and on February 10, 2026, under a link to Koi’s post, MeetingTV’s CEO wrote to DNSFilter: “They never spoke with us even though we are easy to find and respond to email.”

At 16:41 EST on February 11, 2026, according to emails MeetingTV attached to its complaint, a DNSFilter support message said that its clients “expect us to block public IOCs like this, especially with all the VirusTotal hits,” went on, “In my position there is unfortunately nothing I can do about the category in DNSF’s system, because it reflects what our customers expect,” and added, “I might recommend sorting this out with the author as that will probably cause the VirusTotal hits to be cleared.”

What Koi’s post listed

Koi’s DarkSpectre post, as archived on December 30, 2025 and January 23, 2026, lists meetingtv[.]us beside webinarstvus.cloudfunctions[.]net and zoocorder.firebaseio[.]com under a domains heading in its indicator list. In a note dated February 12, 2026, Koi wrote that meetingtv[.]us, “which was originally included in the IOC list,” had “appeared in code analyzed during our investigation,” but that it found “no evidence that this domain is connected or related in any way to the malicious infrastructure or the threat actor group described in this report.” On February 12, in an email attached to MeetingTV’s complaint, Koi’s CEO wrote that the domain “was inside the code of the malware, potentially in order to monitor your domain, so there was no mistake made as to the IOCs of the malicious code.” The defendants’ brief quotes that email as saying Koi had “never made any claims that your company is related to the malicious actors.”

The defendants’ brief says MeetingTV sent Koi “a formal retraction demand” on February 11, 2026, the date MeetingTV’s complaint also gives. In an email dated February 12, 2026, also attached to MeetingTV’s complaint, Koi’s CEO wrote, “we did not mean to cause any harm and I’ll make sure to fix this asap internally.” The section of the defendants’ brief that sets out MeetingTV’s demand and Koi’s February 12, 2026 statements is headed “Based on MeetingTV’s Representations, Koi Ltd. in Good Faith Supplemented its Report.”

Data point or category

MeetingTV’s complaint and the defendants’ brief each describe what an indicator of compromise is. MeetingTV’s complaint alleges that in the cybersecurity industry “an IOC designation is a term of art signaling that a domain, endpoint, or artifact is malicious and should be blocked or treated as a threat.” The defendants’ brief, filed June 30, 2026, says, “Even accepting that pleaded meaning,” that “an IOC is a technical artifact observed during an investigation—a data point, not a verdict.”

On our reading, the records place one entry on different rungs: Koi’s note of February 12, 2026, the defendants’ brief of June 30, 2026 and the DNSFilter form of February 4, 2026 in MeetingTV’s exhibits. The box below sets each rung beside its source. Which rung a reader takes is the question this page leaves open.

The wider record

The defendants’ brief says the complaint pleads that Palo Alto Networks acquired Koi on or about April 14, 2026, months after the report, and that Palo Alto Networks “did not research, author, approve, publish, or update the Report.” The brief also says numerous third parties “reported, flagged, or blocked” MeetingTV-related domains before the report. MeetingTV’s complaint alleges “The blocking commenced on December 31, 2025,” and that its domains “remained blocked and labeled as malicious even after Koi’s limited February 2026 ‘update.’”

The defendants’ brief cites an October 8, 2025 report by CyberAlberta, which the brief calls “a Canadian governmental cybersecurity division.” The report says WebinarTV “is actively scraping and redistributing both public and private Zoom webinars without knowledge or consent of organizers,” and lists meetingtv[.]us, with webinartv[.]us, among its “Known domains for WebinarTV.” Its text does not mention Zoomcorder, China, Koi or DarkSpectre. The same report says, “While WebinarTV’s CEO claims to be compliant with copyright law and offers a takedown process, multiple users have reported unauthorized content uploads and ineffective removal procedures.” According to an email attached to MeetingTV’s complaint, MeetingTV’s CEO wrote to Koi’s CEO on February 12, 2026, “WebinarTV indexes free and public webinars. Public means available to everyone in the world.” The report says the legality of WebinarTV’s practices “likely varies by jurisdiction.” On extensions it lists, it says, “While most of these tools are not directly affiliated with WebinarTV, they serve as common vectors for the potential exposure of private webinar content.”

The report says the organizers of one Alberta ministry webinar “were unable to determine with confidence how the recording appeared online,” but that the incident “coincides with numerous open-source reports of nearly identical events involving WebinarTV.” Separately, a class action complaint filed June 24, 2026, Gaines v. Robertson (S.D. Cal. No. 3:26-cv-03696), alleged “the unlawful interception, recording, use, and public dissemination of private and access-restricted virtual-meeting communications” by Michael Robertson and WebinarTV, Inc. The docket lists an amended complaint filed August 6, 2026 “against MeetingTV, Inc.” MeetingTV has moved to dismiss, arguing in part that the plaintiff “cannot avoid the objective implausibility of his assertion of a ‘reasonable expectation of privacy’ in an admittedly public webinar.” The allegations are untested. Through October 1, 2026, the docket in Gaines showed no ruling on MeetingTV’s motion to dismiss.

The Agentics read

Agentics reads this record, as a fit and not a finding, through Digital Derangement Syndrome™ (DDS™), our term for systems that fail to recognize authority. The nearest characteristic is Authority Misclassification, no more than a fit: on our reading, a filter’s category sits a rung above the listing as Koi describes it. Any failure to recognize is MeetingTV’s allegation.

Where the argument stops

This edition goes only as far as its sources go. The allegations are MeetingTV’s. Koi Security Inc. and Palo Alto Networks, Inc. argue that the report’s analysis is protected opinion and have moved to dismiss the complaint and to strike it under California’s anti-SLAPP statute. The sources this edition read, as of October 2, 2026, do not show whether an AI tool or a person connected meetingtv[.]us to the campaign Koi’s post describes. The public docket listed no ruling on the motion when checked October 2, 2026.

This edition reports on pending litigation from court filings, archived copies of Koi’s post, the agency report the defense cites and The Register. It does not determine whether any party’s claims are true, whether the classification was correct, or what caused any block. The mapping to Digital Derangement Syndrome™ is our editorial reading, not any party’s finding.