diff --git a/lib/services/campaign-classifier.test.ts b/lib/services/campaign-classifier.test.ts
index 2aaf44e..7295bb7 100644
--- a/lib/services/campaign-classifier.test.ts
+++ b/lib/services/campaign-classifier.test.ts
@@ -60,6 +60,20 @@ describe('domainMatchesAllowlist', () => {
     expect(domainMatchesAllowlist('it-support.care.attacker.net')).toBe(false);
     expect(domainMatchesAllowlist('evil-it-support.care')).toBe(false);
   });
+
+  it('matches the 3 KnowBe4 domains confirmed via Seubert ticket 699456 (260717-a19)', () => {
+    expect(domainMatchesAllowlist('customer-portal.info')).toBe(true);
+    expect(domainMatchesAllowlist('cloud-service-care.com')).toBe(true);
+    expect(domainMatchesAllowlist('bankonlinesupport.com')).toBe(true);
+  });
+
+  it('matches a subdomain of the newly-added customer-portal.info', () => {
+    expect(domainMatchesAllowlist('mail.customer-portal.info')).toBe(true);
+  });
+
+  it('does NOT match a suffix-spoofed variant of the newly-added domain', () => {
+    expect(domainMatchesAllowlist('customer-portal.info.attacker.net')).toBe(false);
+  });
 });
 
 describe('isKnownSimulationSender', () => {
diff --git a/lib/services/campaign-classifier.ts b/lib/services/campaign-classifier.ts
index 4a120e9..45c0b7b 100644
--- a/lib/services/campaign-classifier.ts
+++ b/lib/services/campaign-classifier.ts
@@ -33,8 +33,17 @@ import { getBlastRadius, type BlastRadiusResult } from './mimecast-blast-radius'
 export const KNOWN_SIMULATION_SENDERS: readonly { vendor: string; domains: readonly string[] }[] = [
   {
     vendor: 'knowbe4',
-    // 219 tickets, ~37 impersonated personas — 19-RESEARCH.md D-07 finding #2
-    domains: ['it-support.care'],
+    // 219 tickets, ~37 impersonated personas — 19-RESEARCH.md D-07 finding #2.
+    // customer-portal.info, cloud-service-care.com, bankonlinesupport.com
+    // confirmed via shared /render-template/ + /tracking/ URL fingerprint
+    // across Seubert tickets 699419/699421/699422/699433/699435/699456 on
+    // 2026-07-16/17 (quick task 260717-a19).
+    domains: [
+      'it-support.care',
+      'customer-portal.info',
+      'cloud-service-care.com',
+      'bankonlinesupport.com',
+    ],
   },
   {
     vendor: 'breach-secure-now',