en[.]novaspringsave[.]pro

Analysis of en.novaspringsave.pro indicates the domain is currently offline but was previously identified as a generic phishing site targeting cryptocurrency users. The page title retrieved before takedown, "Home - Web3 Security Vault - A crypto buy and sell marketplace," suggests a fraudulent impersonation of a crypto exchange service. Infrastructure examination shows the domain resolved to IP address 147.93.73.139, hosted by Hostinger International Ltd. in Lithuania and associated with the LiteSpeed web server, Alpine.js, jsDelivr, and HTTP/3 transport. No SSL certificate was presented, leaving the site exposed to credential interception and reinforcing its malicious intent.

The registrar information confirms registration through Hostinger Operations UAB, a known bulk‑registration provider. Trust assessment from Gridinsoft assigned a score of 0 / 100, reflecting a high likelihood of abusive behavior. VirusTotal analysis recorded two detections out of ninety‑four scanning engines, indicating that at least a pair of security vendors flagged the domain for malicious activity. The domain appears on a single blocklist and is actively blocked by the PhishDestroy service, further corroborating its threat status.

Despite the offline state, defenders should continue to monitor the associated IP address for any resurgence of malicious hosting, enforce blocking of the domain and its IP in network defenses, and update URL filtering policies to include en.novaspringsave.pro. Additional scrutiny of any future DNS records linked to the same registrar or hosting provider is advised, as similar campaigns often reuse infrastructure. The absence of an SSL certificate, combined with the low trust score and detection history, provides concrete evidence for elevated risk classification and justifies continued defensive measures.