nv41[.]live

The domain nv41.live was registered on 7 November 2025 through NiceNIC International Group Co., Limited and is currently listed as taken offline. DNS resolution points to the Cloudflare edge address 172.67.177.162, which is associated with AS13335 Cloudflare, Inc. in the United States. The authoritative name servers are leo.ns.cloudflare.com and alexia.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s CDN and WAF infrastructure. No SSL certificate is presented for the site, indicating that HTTPS was not configured at the time of analysis. Passive intelligence shows that the page title returned by the site is “Nova”.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans report that five of ninety‑five security vendors flagged the domain, suggesting a modest but non‑trivial detection rate. Gridinsoft assigned a trust score of 0 out of 100, and AlienVault OTX includes the domain in one threat‑intel pulse, reinforcing the malicious classification. The available evidence points to a generic phishing operation, although the specific lure or credential‑stealing template has not been captured. Because the site is offline, live content cannot be examined, and the exact phishing vector remains uncertain.

Defenders should continue to block the domain at perimeter filters, update URL filtering lists with the observed IP and name‑server information, and monitor for any re‑hosting attempts that might reuse the same Cloudflare edge address. Additional scrutiny of traffic to 172.67.177.162 from internal users is recommended, as the address is shared among many unrelated Cloudflare customers. Organizations that rely on threat‑intel feeds should incorporate the OTX pulse and the PhishDestroy blocklist entry into their detection rules. Continuous re‑scanning of the domain, should it become active again, will be necessary to capture any new payloads or credential‑harvesting pages.