knowledbase[.]store

PhishDestroy identifies knowledbase.store as an active phishing domain under investigation for generic phishing activities. This domain does not appear to impersonate a specific brand or utilize a known drainer kit, suggesting a broad, opportunistic phishing campaign targeting unsuspecting users. The domain is hosted on infrastructure commonly associated with low-cost, high-volume malicious activities, with no immediate signs of sophisticated evasion techniques. Initial analysis indicates the threat actor is leveraging basic phishing tactics, likely relying on user error rather than technical sophistication. knowledbase.store resolves to IP address 172.67.154.213 and utilizes an SSL certificate issued by Google Trust Services, which may be leveraged to lend false legitimacy to the domain. VirusTotal currently reports 0 detections out of 95 security vendors, indicating that mainstream detection systems have not yet flagged this domain. The domain was created recently, though the exact creation date is not yet confirmed in open-source intelligence databases. The registrar has not been disclosed in available records, but the domain's infrastructure aligns with hosting providers known for lax abuse controls. The domain has not been flagged by Google Safe Browsing (GSB) at the time of this report, nor has it been listed on major threat intelligence blocklists, leaving it in a pre-emptive state where proactive blocking is not yet widely implemented. As of this report, knowledbase.store remains active and unblocked by most security systems, presenting a moderate yet evolving risk. PhishDestroy has flagged the domain for further behavioral analysis due to its potential to expand into broader phishing operations or evolve into a more targeted campaign. Immediate mitigation actions include monitoring for traffic redirection to known malicious endpoints and updating network blocklists to include this domain. Users and organizations are advised to avoid interacting with knowledbase.store and to report any suspicious activities associated with this domain to their security teams or relevant threat intelligence platforms. The risk level remains under investigation, but the lack of detections and active status warrant caution.