knowledge-nexus-ai[.]gitbook[.]io

knowledge-nexus-ai.gitbook.io is currently active and hosts a social‑media phishing campaign that masquerades as Discord. The site resolves to 172.64.147.209, an IP address owned by Cloudflare (AS13335) and located in the United States. DNS resolution is served by the Cloudflare nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare’s CDN and protection services. The HTTP response is a 307 temporary redirect, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming that the domain uses a valid HTTPS certificate despite its malicious purpose.

The page title returned by the server is “Overview | Knowledge Nexus AI”, which does not reference Discord and suggests that the underlying content may be hosted on a GitBook documentation site. Detected technologies include GitBook, Google Cloud, HSTS, Google Cloud Trace, Cloudflare, and HTTP/3, all consistent with a modern hosting stack. VirusTotal has flagged the domain in 12 of 95 scanners, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious classification. The domain was created on 30 March 2014 and is listed on at least one public blocklist, PhishDestroy, confirming that security‑industry feeds have already identified it as abusive.

No additional intelligence such as Safe Browsing or OTX references is available in the current dataset. Given the observed indicators—high‑risk brand impersonation of Discord, active status, Cloudflare‑based hosting, valid TLS, and multiple vendor detections—defenders should block both the domain and its hosting IP at perimeter defenses, monitor DNS queries for the listed nameservers, and add the domain to internal phishing‑detection rules. Continuous re‑scanning is advised to capture any changes to the underlying content, as the current page title does not reveal the phishing payload.