noicax[.]com

PhishDestroy identifies noicax.com as a recently activated crypto drainer domain designed to harvest cryptocurrency wallet credentials under active threat status. The domain exhibits behavioral patterns consistent with generic phishing kits targeting blockchain users, with no specific brand impersonation detected at this stage. The infrastructure appears to be provisioned for quick deployment and evasion, given the recent domain registration and minimal detection coverage. This domain was flagged with a VirusTotal detection score of 6/95, indicating no antivirus or security engine has yet classified it as malicious. It resolves to IP address 172.67.165.80 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 18, 2026. The SSL certificate is issued by Let's Encrypt, a common choice among phishing operators seeking to appear legitimate. At the time of analysis, the domain remains unlisted on Google Safe Browsing (GSB) and has not been widely blocked across major threat intelligence platforms, suggesting early-stage operation. The threat remains under investigation with an 'active' status, though risk is currently assessed as 'under_investigation' due to limited detection coverage. PhishDestroy advises immediate caution: avoid interaction with noicax.com or any associated links. Users should verify domains via trusted threat intelligence sources before engaging. While the immediate risk is elevated due to low detection, proactive blocking and public reporting can help prevent wider victimization. Remaining risk depends on the speed of detection engine updates and potential expansion of malicious infrastructure.