noborup[.]tv

Analysis of noborup.tv shows that the site was hosted on IP 103.174.50.27, belonging to AS147181 Flarezen Ltd. in Bangladesh. The domain was registered on June 20, 2020 through PublicDomainRegistry.com (PDR Ltd.) and uses the nameservers bd1.ecarehost.com and bd2.ecarehost.com. The site presented a valid HTTPS certificate issued by Let’s Encrypt (R13) and responded with HTTP 200. Content detection identified a WordPress installation backed by MySQL and PHP, with LiteSpeed web server, jQuery libraries, and HTTP/3 support. The page title observed was “NoborupTV – নতুনত্বে আমরা”, which does not reveal a direct impersonated brand.

Gridinsoft assigned a trust score of 0/100, indicating a lack of trust. The domain appears on a single security blocklist and is blocked by PhishDestroy. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, confirming that at least one vendor flagged the domain as malicious. The site has been taken offline as of the report date. The evidence points to a generic phishing operation, but the specific lure or credential collection mechanism has not been publicly disclosed.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP or hosting provider, and consider adding the IP address to internal threat intelligence feeds. Because the site used a legitimate TLS certificate, reliance on certificate validation alone is insufficient. Continuous monitoring of the registrar and name server changes is recommended, as well as periodic re‑scans in VirusTotal or similar platforms to capture any new detections. The limited blocklist presence suggests low exposure, but the presence of a positive detection warrants caution.