novarexcaptial[.]live

The domain novarexcaptial.live is identified as a phishing site designed to impersonate a legitimate financial trading platform offering contracts for difference (CFD) on stocks, gold, oil, and indices. Analysis indicates this domain specifically targets users seeking investment opportunities by mimicking the branding and services of established trading entities. The site is currently classified under generic_phishing with an elevated risk level due to its deceptive practices aimed at harvesting sensitive financial and personal credentials. Infrastructure analysis reveals the domain was registered on February 21, 2026, through OwnRegistrar, Inc., a registrar frequently associated with high-risk domains. It resolves to the IP address 198.251.89.34 and has been flagged by 7 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0 out of 100, further confirming its fraudulent nature. The site employed a Let's Encrypt SSL certificate, a common tactic among phishing operators to create a false sense of security for visitors. As of the latest assessment, novarexcaptial.live has been taken offline, likely due to enforcement actions or cessation of the campaign. However, users who may have interacted with the site are advised to immediately revoke any shared credentials, monitor financial accounts for unauthorized activity, and run antivirus scans to detect potential malware. Organizations should update blocklists to include this domain and its associated IP address, while security teams are encouraged to review logs for connections to 198.251.89.34 as an indicator of compromise.