knowles-firm[.]com

PhishDestroy identifies knowles-firm.com as a live phishing domain currently under active investigation for hosting a generic phishing page. The domain shows no VirusTotal detections at this time (1/95 engines), but suspicious traits include a Let’s Encrypt SSL certificate and a March 21, 2026 creation date—indicating a very recent, likely opportunistic setup. While no specific brand or drainer kit has been confirmed, the combination of new registration, low VT score, and live resolution suggests a fast-moving threat actor leveraging bulk domain generation for credential harvesting or malware delivery. This domain was registered through URL SOLUTIONS INC. and resolves to IP 194.48.203.204. Threat intelligence confirms zero VirusTotal detections (1/95), no current Google Safe Browsing (GSB) block, and no known presence on major blocklists at this stage. The domain’s youth and use of a reputable SSL issuer may be tactics to evade early detection filters. Despite the absence of detections, the active phishing status and presence in monitoring pipelines indicate a credible risk of exploitation within 24–48 hours. Current status: active and under investigation with zero detections on VirusTotal as of seed 587bb5. Response actions include ongoing monitoring, IP/domain takedown coordination with hosting providers, and browser warning flagging. Remaining risk is assessed as HIGH due to the domain’s freshness, active status, and lack of signature-based detection. Users are advised to block 194.48.203.204 at the network level and avoid visiting knowles-firm.com. Organizations should update firewall rules and endpoint protections to block this domain and IP immediately.