noowex[.]com

Analysis of noowex.com indicates a high-risk credential-harvesting operation targeting Instagram users. The domain was registered on May 9, 2026, through a registrar known for bulk registrations, and remains active as of July 12, 2026. The page title explicitly states 'Instagram Automation,' aligning with the brand impersonation classification. Infrastructure analysis reveals Cloudflare hosting (104.21.8.63, CA) with nameservers bob.ns.cloudflare.com and priscilla.ns.cloudflare.com, and an SSL certificate issued by Google Trust Services (WE1). Detected technologies include Swiper, jQuery, and Cloudflare Browser Insights, suggesting a dynamic frontend likely designed to mimic legitimate automation tools. Defenders should note that the domain appears on one security blocklist, and two of 92 security vendors on a recent scan flagged it as malicious. The HTTP status returns 200, confirming the site is accessible. While the exact content of the site has not been analyzed, the combination of brand impersonation, page title, and hosting on a content delivery network commonly used to obscure origin servers supports the classification of a credential-harvesting campaign. No evidence of malware distribution or additional payload delivery is present in the available data. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to the IP 104.21.8.63, and alerting users who may have interacted with the site. The domain's registration age (64 days) and continued activity suggest it may remain operational unless disrupted. Further analysis of the site's content and backend infrastructure could provide additional indicators, but current data is sufficient to classify this as a confirmed impersonation threat.