noccor[.]info

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, noccor.info, was registered on April 28 2026 by Fewmoretaps OU operating as Trustname.com. The site presents a Russian‑language page titled “NOCOR! НЕТ КОРРУПЦИИ! Сайт журналистских расследований”, which translates to a journalism‑focused anti‑corruption portal. The domain resolves to the IPv4 address 136.110.246.83, hosted on a United‑States cloud infrastructure. HTTP requests return a status code 200 and the site presents a valid SSL certificate issued by a public certificate authority, indicating a correctly configured TLS layer. Infrastructure analysis shows the domain is delegated to the Cloudflare nameservers eve.ns.cloudflare.com and troy.ns.cloudflare.com. The same IP appears on a single security blocklist and has been flagged by PhishDestroy. AlienVault OTX lists the domain in one threat‑intelligence pulse, suggesting that at least one community source has identified malicious use. No detections are reported on the 95‑engine VirusTotal scan, and the Gridinsoft trust score is 0 / 100, reflecting a lack of historical reputation. Current evidence points toward a credential‑harvesting campaign, given the generic phishing classification and the presence of a public‑facing page that could be leveraged to lure victims. However, the exact luring vector, payload, and target audience remain undefined because no malware samples or phishing emails have been publicly released. The absence of detections on major scanning platforms does not confirm benign intent; it only indicates that automated tools have not yet flagged the content. Defenders should treat noccor.info as hostile. Immediate actions include adding the domain and its resolving IP to outbound filtering rules, monitoring DNS queries for the nameservers, and instrumenting TLS inspection to capture any credential submissions. Continuous threat‑intel monitoring is advised to detect any emergence of related indicators, such as new phishing templates or compromised accounts associated with the site.