noblepayz[.]com

This domain is flagged across threat intelligence sources as an active high-risk instance of generic phishing. Registered on March 11, 2026 via TuringSign Inc. d/b/a Cosmotown, noblepayz.com continues to resolve to 192.142.54.88 with a Let's Encrypt certificate as of July 12, 2026. It appears in 23 AlienVault OTX pulses, sits on two security blocklists, and carries a Gridinsoft trust score of 0/100. VirusTotal records detections by 3 of 95 vendors, while block actions from PhishDestroy and BLP-Malware reinforce the malicious designation. The page title matches the domain name directly.

Infrastructure analysis reveals a PHP stack augmented by Bootstrap, jQuery, GSAP, OWL Carousel and JivoChat, delivered through LiteSpeed with HTTP/3 enabled. These components align with common patterns observed in phishing deployments, though exact configuration details remain unexamined. Registration age of roughly four months places the domain within typical operational windows for such infrastructure without indicating anomalous timing.

Certain aspects stay uncertain, including the precise visitor-facing content and any specific targeting criteria, because direct site inspection has not been performed. No brand references appear in the supplied page title or threat classification. Defenders should therefore treat the indicators as generic rather than brand-specific.

Recommended actions include immediate blocking of noblepayz.com and 192.142.54.88 at perimeter controls, addition of the domain to internal watchlists, and correlation of any observed connections against existing logs. Ongoing review of blocklist updates incorporating the reported pulse count and vendor detections supports continued containment efforts.