noxa2[.]fi

Analysis of the domain noxa2.fi, observed on July 19, 2026, shows it is actively serving content and returns HTTP status 200. The page title "NOXA Fun — Launch. Trade. Earn." suggests a promotional or financial theme, but no further page content has been disclosed. The domain is presently blocked by three independent blocklists—PhishDestroy, MetaMask, and SEAL—and appears on three additional security blocklists, indicating consensus among threat‑intelligence feeds that the site is malicious. Technical infrastructure reveals the domain resolves to IP address 188.114.97.3, hosted within CloudFlare’s network in Canada, and the TLS certificate is issued by Google Trust Services under the WE1 authority, providing a valid‑looking HTTPS connection. No detections have been reported by the 91 VirusTotal scanners that examined the site, but the absence of detections does not confirm safety. Given the classification as generic phishing, the primary risk is credential harvesting or fraudulent financial solicitation directed at unsuspecting visitors. Defenders should add noxa2.fi to network‑level deny lists, enforce DNS filtering, and monitor outbound connections to the associated IP. Continuous re‑evaluation is advised, as the site remains active and could evolve its payload or targeting.