novavpn[.]org

This domain was registered through Ultahost, Inc. on March 11, 2026. The site presents the page title "NOVA VPN" and resolves to the IPv4 address 192.142.45.116, which belongs to AS214036 operated by Ultahost, Inc. in the Netherlands. The hosting environment reports Ubuntu operating system and Nginx web server. No TLS certificate is deployed, meaning the site is only reachable over HTTP.

The domain appears on a single public blocklist, PhishDestroy, indicating that at least one anti‑phishing service has flagged it. VirusTotal analysis shows one positive detection out of ninety‑five scanning engines, confirming that at least one vendor identified malicious behavior. The authoritative name servers are ns1.ultahost.com through ns4.ultahost.com, all consistent with the registrar's infrastructure. As of the report date, the site is reported offline, and no further HTTP response can be observed.

Evidence points to a newly created infrastructure that aligns with typical generic phishing deployments: rapid registration, lack of encryption, and placement on a phishing‑focused blocklist. However, the limited number of detections and the offline status leave the current activity level uncertain. Defenders should continue to block traffic to novavpn.org at perimeter filters, monitor DNS queries for the associated IP and name servers, and consider adding the domain to internal blocklists. Additional investigation, such as requesting the original page content via archival services, may reveal the exact phishing payload or targeted brand, if any.