novatrustglobalinvestment[.]com

Analysis of the domain novatrustglobalinvestment.com indicates it is actively involved in phishing operations targeting financial or investment sectors. The domain was registered on January 7, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu and currently resolves to the IP address 188.114.97.3, which is part of Cloudflare’s infrastructure, as evidenced by its nameservers (dante.ns.cloudflare.com and maeve.ns.cloudflare.com). As of July 27, 2026, the domain remains active and appears on one security blocklist, specifically PhishDestroy. VirusTotal scanning results show that 2 out of 91 security vendors have flagged this domain as malicious, though the specific detection rationale is not provided in the available data.

The domain’s infrastructure does not reveal additional context about its target or the exact nature of the phishing content, as no brand name, page title, or scam kit details are present in the provided intelligence. The use of Cloudflare nameservers is common among both legitimate and malicious domains, offering limited insight into the domain’s intent beyond its association with phishing activity. The registration date suggests the domain is relatively new, which aligns with typical patterns observed in phishing campaigns where domains are frequently rotated to evade detection. Defenders should treat this domain as high-risk and consider implementing network-level blocks for the domain and its associated IP address (188.114.97.3).

Monitoring for related domains registered through the same registrar or utilizing identical nameserver configurations may help identify additional threats. Given the domain’s presence on a security blocklist and the detection by multiple vendors, further investigation into its hosting environment and potential connections to broader phishing campaigns is recommended. No evidence of takedown or mitigation efforts is currently available, and the domain remains operational.