novacheat[.]com

This domain is flagged as a confirmed malware-distributing phishing site targeting users seeking unauthorized game modifications or cheats. Analysis indicates the site masquerades as a legitimate cheat provider, likely deploying malicious payloads under the guise of "free downloads." The threat type is classified as a drive-by download or trojan distribution vector, with elevated risk due to its targeting of a high-risk user demographic (gamers seeking cheats or exploits). Infrastructure analysis reveals the domain was registered on June 07, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive domains. It resolves to the IP address 188.114.96.3, which is part of a network with a history of hosting malicious content. The site is detected by 8 out of 95 security vendors on VirusTotal, appears on one security blocklist (PhishDestroy), and is referenced in two AlienVault OTX threat intelligence pulses. Technologies detected include Node.js, Vue.js, Nuxt.js, and Cloudflare infrastructure, which may be leveraged to obfuscate malicious activity or evade detection. The domain is currently offline, but its prior activity and infrastructure warrant continued monitoring. Mitigation steps for organizations and end-users include blocking the domain and its resolving IP (188.114.96.3) at the network level. Security teams should prioritize scanning endpoints for indicators of compromise, particularly those associated with gaming or cheat-related downloads. Users should be educated on the risks of downloading unauthorized software, especially from domains with recent creation dates or those hosted on high-risk registrars. Additionally, monitoring for related domains registered through PDR Ltd. or resolving to the same IP range may help preemptively identify similar threats. If the domain reactivates, security controls should be updated to reflect its confirmed malicious status.