app-noya[.]xyz

The domain app-noya.xyz is flagged as a high‑risk generic phishing site and remains active as of July 12 2026. The indicator was originally observed by multiple phishing‑focused blocklists and continues to resolve to the same address, confirming the persistence of the threat infrastructure.

Infrastructure analysis shows the domain was registered on April 29 2026 through Dynadot LLC and is served by Cloudflare’s DNS with the authoritative nameservers eleanor.ns.cloudflare.com and jakub.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3, which is geolocated to Canada and belongs to Cloudflare, Inc. The site presents a valid Let's Encrypt certificate (serial E8), indicating the operators have obtained a free TLS certificate to give the site a legitimate appearance.

Reputation data corroborates the malicious intent. The Gridinsoft trust score is 0 / 100, and the domain appears on two public blocklists, including PhishDestroy and ScamSniffer, both of which have actively blocked traffic to the host. VirusTotal reports that 3 of 95 security vendors have flagged the domain, and AlienVault OTX includes it in one threat‑intel pulse. An HTTP request to the site returns a 403 status code, suggesting that the front‑end may be restricting access to certain user agents or IP ranges, a tactic sometimes used to evade automated analysis.

Defenders should add app-noya.xyz to network‑level deny lists and enforce DNS sinkholing for the domain. Continuous monitoring of DNS queries for the associated Cloudflare nameservers is advised, as any change could indicate a shift in hosting or a new campaign launch. Because the site uses a legitimate TLS certificate and a cloud‑based CDN, deeper packet inspection may be required to detect malicious payloads hidden behind encrypted traffic. Analysts should also watch for any new detections that reference the same IP address or certificate, as these could point to expanded infrastructure tied to the same threat actor.