novaex[.]io

The domain novaex.io was registered on February 21, 2026 and is presently taken offline. DNS resolution points to the IP address 172.67.173.119, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, indicating the use of a standard SSL wrapper without additional validation. VirusTotal analysis shows three of ninety‑five security vendors flagging the domain, confirming malicious activity.

The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft’s trust scoring system rates the domain at 0 out of 100, reflecting a complete lack of credibility. The page title retrieved from the site reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | NovaEX,” and the campaign is classified as a crypto scam that impersonates the Ethereum brand. No further intelligence such as Safe Browsing verdicts, Open Threat Exchange entries, or registrar details is available in the current dataset.

Uncertainty remains regarding the specific phishing kit or the exact content served to victims, as the site has not been captured for deeper forensic analysis. Defenders should continue to block the IP address 172.67.173.119 and the domain novaex.io at network perimeters, add the domain to internal blacklists, and monitor for any re‑registration attempts or related infrastructure reuse. Ongoing surveillance of Cloudflare‑hosted assets tied to this ASN is advisable, as threat actors frequently leverage shared hosting environments to rotate malicious sites.