noxachain[.]live

Analysis of the domain noxachain.live, created on July 23, 2026, shows an infrastructure consistent with a generic phishing operation. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and utilizes Cloudflare name servers cullen.ns.cloudflare.com and mona.ns.cloudflare.com, indicating reliance on a widely used CDN service for hosting and DDoS mitigation. DNS resolution points to IP address 104.21.74.194, a Cloudflare‑owned address that masks the underlying hosting provider, a common tactic to obscure the true server location.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one threat intelligence source has identified malicious activity associated with the domain. VirusTotal reports that the domain has been scanned by 91 antivirus and URL‑reputation vendors, none of which have issued a detection at the time of the scan; this lack of detections does not constitute a safety assertion, as the absence may result from limited coverage or recent deployment. Current public indicators do not reveal additional metadata such as SSL certificate details, HTTP response codes, or page content, leaving those aspects unverified.

Given the recent registration date, the presence on a blocklist, and the use of Cloudflare infrastructure, defenders should treat noxachain.live as a high‑confidence phishing indicator. Recommended mitigation actions include adding the domain to network‑level deny lists, configuring web‑proxy blocks, and monitoring for any related DNS queries or outbound connections to the resolved IP address. Continuous re‑evaluation is advised, as further analysis may uncover additional malicious artifacts or victim targeting patterns.