news[.]knowledia[.]com

Analysis of news.knowledia.com, created on February 21, 2026, shows an active infrastructure that aligns with a high‑risk generic phishing classification. The domain resolves to IP address 104.21.27.27, which is part of the Cloudflare network (AS13335) located in the United States. Nameserver entries point to clarissa.ns.cloudflare.com and guy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. Registration was performed through Squarespace Domains II LLC, a legitimate registrar, but the low Gridinsoft trust score of 0 out of 100 indicates a lack of historical reputation and suggests malicious intent.

The site returns an HTTP 301 redirect, and its SSL certificate is issued by Google Trust Services under the WE1 identifier, providing standard TLS encryption but not mitigating the phishing risk. Detected technologies include particles.js, Varnish, GitHub Pages, and Fastly, a combination that may be used to serve dynamic content while leveraging caching and content delivery services. The domain appears on a single security blocklist and has been flagged by PhishDestroy, reinforcing the suspicion of phishing activity. VirusTotal scans show two of ninety‑three security vendors flagging the domain, a modest but notable detection rate.

The page title "Knowledia News - Service Discontinued" does not reveal any legitimate service and may be intended to lure users. While the exact phishing payload or credential‑capture page has not been publicly disclosed, the convergence of a recent creation date, zero trust score, redirection behavior, and multiple vendor detections warrants immediate defensive action. Organizations should block the domain at network perimeter and proxy layers, update threat‑intelligence feeds with the observed indicators, and monitor for any outbound connections to the associated IP address. Continuous re‑evaluation is advised, as the active status and high risk level suggest the campaign may evolve or expand.