norowex[.]com

Analysis of the domain norowex.com shows that it was registered on 21 February 2026 through Web Commerce Communications Limited and immediately pointed to Cloudflare’s network (nameservers lia.ns.cloudflare.com and yadiel.ns.cloudflare.com, IP 172.67.150.30, AS13335, United States). The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating standard Cloudflare SSL termination. A HTTP GET returns a 403 status and the page title is “Suspected phishing site | Cloudflare”, which is a generic Cloudflare warning page rather than the original content. The site is classified as a Social Media Phishing campaign and the underlying kit has been identified as the “Gambler Scam” package.

VirusTotal scanning recorded 13 detections out of 93 security vendors, and the domain appears on a single external blocklist that has been integrated by PhishDestroy. Gridinsoft assigns a trust score of 1 / 100, reinforcing the malicious assessment. The domain is currently taken offline, but the infrastructure—Cloudflare front‑end, the same IP address and the registrar—remains usable for rapid re‑deployment. Uncertainty remains around the specific social media platform targeted and the exact payload delivered, as no content analysis beyond the Cloudflare warning page is available.

Defenders should block the domain and its associated IP at perimeter and DNS levels, monitor for re‑use of the same nameservers or IP range, and incorporate the indicator set (domain, IP, nameservers, SSL fingerprint) into threat‑intel feeds. Continuous re‑scanning on VirusTotal and other multi‑engine services is advised to capture any changes in detection ratios. Organizations that rely on social‑media authentication flows should enforce MFA and educate users about unsolicited login requests, as the campaign likely attempts credential harvesting.