nvmp11[.]live

Analysis of the domain nvmp11.live, created on March 12, 2026, indicates that it is currently offline but was previously identified as part of a generic phishing campaign. The domain resolves to the IP address 104.21.91.206, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. Hosting is provided through Cloudflare, as evidenced by the authoritative nameservers alexia.ns.cloudflare.com and leo.ns.cloudflare.com. No TLS certificate was observed for the site, implying that HTTPS was not configured at the time of capture. The page title returned by the server was "Nova," but no further content analysis is available because the site is no longer reachable.

Reputation checks show that the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans recorded two positive detections out of ninety‑four security vendors, reinforcing the suspicion of malicious intent. The limited detection count suggests that the domain may have been short‑lived or that broader awareness has not yet been achieved.

Defenders should consider the domain malicious and add it to local blocklists, enforce DNS filtering, and monitor for any residual traffic to the associated Cloudflare IP. Given the lack of an SSL certificate and the offline status, any active exploitation is likely concluded, but the infrastructure could be repurposed for future campaigns. Continuous observation of the IP address and related Cloudflare assets is advised to detect potential reuse.