knoxweb3net[.]com

Analysis of knoxweb3net.com shows a newly registered domain created on 21 February 2026 by the registrar Spaceship, Inc. The domain resolves to the IPv4 address 86.107.77.205, which is assigned to AS216395 HostBet Cloud Technologies Private Limited and geolocated to Germany. The hosting stack reports LiteSpeed web server, Alpine.js frontend framework, and HTTP/3 support, indicating a modern configuration. The SSL certificate is issued by Let’s Encrypt (R12), providing valid HTTPS encryption but offering no indication of legitimacy. The page title returned during the last crawl was “1 new message”, consistent with a generic phishing landing page.

VirusTotal scans returned six positive detections out of ninety‑three scanners, confirming malicious intent. Independent blocklist monitoring shows inclusion on four public blocklists, and the domain is currently listed by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigns a trust score of 0 / 100, reinforcing the classification. The supplied intelligence tags the campaign as an investment scam, though no additional details about the targeted assets or lure mechanisms are available.

The site was taken offline at the time of observation, so live content could not be verified. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP for any re‑use, and add the domain to internal threat intel feeds. Because the infrastructure uses a reputable certificate authority and modern web stack, future variants may appear under different subdomains or with similar hosting; ongoing watch of the registrar Spaceship, Inc. and the AS216395 block may reveal related activity. Until further evidence emerges, the domain should be treated as a high‑confidence malicious phishing source.