noveraxcapital[.]com

noveraxcapital.com is currently listed as a high‑risk generic phishing infrastructure. The domain was registered on February 21, 2026 through Dynadot LLC and is hosted on the IP address 199.191.50.229, which is allocated to Confluence Networks Inc (AS40034) in the United States. Authoritative nameservers resolve to 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com, indicating use of a third‑party DNS provider.

The web service presents a page titled “mamma” and issues an HTTP 302 redirect, suggesting an attempt to move victims to a secondary location after initial contact. Server headers reveal the presence of Microsoft ASP.NET running on the Kestrel web server, and the site is protected by a Let's Encrypt R13 TLS certificate. These components are commonly observed in compromised or malicious hosting environments.

Reputation data corroborates malicious use. The domain appears on one external security blocklist and is referenced in a single AlienVault OTX pulse. VirusTotal scans have flagged the domain by 13 of 95 security vendors, while Gridinsoft assigns a trust score of 1 out of 100, reflecting extreme suspicion. Active blocking by the PhishDestroy community further confirms that the site is being used for phishing campaigns.

Defenders should add noveraxcapital.com and its resolving IP 199.191.50.229 to deny‑list rules in perimeter firewalls, DNS filters, and email gateways. Continuous monitoring of the associated nameservers and any future TLS certificate changes is advised, as the infrastructure could be repurposed. Organizations that have observed credential‑collection attempts matching the “mamma” page title should correlate logs against this indicator to identify compromised accounts.