noxtrom[.]app

noxtrom.app was registered on 21 February 2026 and is currently offline. DNS resolution points to the IPv6 address 2606:4700:3030::6815:1f39, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site served an SSL certificate labeled WE1 and returned the HTTP title “Just a moment…”, indicating that the page was likely a placeholder or a Cloudflare challenge page rather than a fully rendered phishing landing page. The domain appears on a single security blocklist; PhishDestroy has listed it as a malicious resource and the blocklist entry is the only public listing recorded.

Scamadviser assigns a trust score of 25 out of 100, reflecting low confidence in the domain’s legitimacy. VirusTotal analysis shows that two of ninety‑three scanning engines flagged the domain, confirming that at least a minority of security vendors consider it suspicious. No further evidence, such as malware hashes, compromised credential submissions, or active phishing kits, has been disclosed. The combination of a recent registration date, low trust rating, Cloudflare‑hosted IP, and limited blocklist presence suggests that the domain was likely created for a short‑lived phishing campaign and taken down shortly after deployment.

Defenders should continue to monitor DNS queries for the IPv6 address 2606:4700:3030::6815:1f39 and block traffic to it at the network perimeter. Existing URL filtering solutions should be updated to include the domain in blocklists, and endpoint protection products should be configured to flag any attempts to resolve or connect to the host. Because the site is offline, immediate investigation of any payloads is not possible, but analysts should retain the domain’s indicators of compromise for correlation with future phishing activity that may reuse the same hosting infrastructure or certificate profile.