ninenotemusic[.]com

The domain ninenotemusic.com was registered on September 24, 2025 through Squarespace Domains LLC and is currently classified as a high‑risk generic phishing site. It remains active as of the report date, July 12, 2026, and returns an HTTP 301 redirect. The page title observed on the live host is “Amagra Production,” but no further content analysis is available.

Infrastructure analysis shows the domain resolves to IP address 104.21.53.96, which belongs to AS13335 Cloudflare, Inc. The host is served behind Cloudflare’s network, leveraging HTTP/3 protocol support. TLS termination is performed by a Google Trust Services certificate (WE1), indicating a valid public‑trusted chain. Authoritative nameservers are dolly.ns.cloudflare.com and nick.ns.cloudflare.com, both consistent with the Cloudflare service.

Reputation data indicates a Gridinsoft trust score of 0 out of 100, and VirusTotal reports that 4 of 95 security vendors have flagged the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed, confirming its presence in threat‑intelligence feeds. These signals collectively reinforce the high‑risk assessment.

While the observed page title provides limited context, the lack of detailed content inspection means the specific phishing payload, credential‑harvesting mechanisms, or targeted brand remain unknown. Analysts should treat the site as a potential credential‑stealing vector until deeper content analysis can be performed.

Defenders are advised to block ninenotemusic.com at perimeter and DNS layers, monitor for outbound connections to the associated Cloudflare IP, and incorporate the domain into threat‑intel feeds. Continuous re‑evaluation is recommended, as changes to the hosting configuration or content could alter the threat profile.