novaxtrades[.]com

Analysis of novaxtrades.com indicates a high-risk phishing domain actively targeting users as of July 24, 2026. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is currently resolving to IP 188.114.96.3, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Microsoft ASP.NET, Bootstrap, SweetAlert2, OWL Carousel, jsDelivr, jQuery, and JivoChat, alongside Cloudflare's CDN and security services. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites, offering no definitive indication of intent.

The domain is flagged by four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and has been classified as malicious by 2 of 93 security vendors on VirusTotal. The page title, 'novaxtrades,' provides no explicit brand association, and the exact nature of the phishing content remains unconfirmed due to lack of deeper forensic analysis. MX records point to igw08.site4now.net with a priority of 10, which may be leveraged for credential harvesting or follow-up phishing emails. Defenders should treat this domain as an active threat.

Immediate actions include blocking the domain and its associated IP (188.114.96.3) at the network perimeter, monitoring for connections to the MX host (igw08.site4now.net), and alerting users to avoid interaction. Given the Cloudflare hosting and lack of transparency in the domain's purpose, further investigation into related infrastructure (e.g., nameservers glen.ns.cloudflare.com and piper.ns.cloudflare.com) is recommended to identify potential linked campaigns. The Gridinsoft trust score of 1/100 reinforces the high-risk classification, though defenders should rely on multiple indicators rather than a single metric.