https://noctua.paris/
104.21.62.70 · Cloudflare, Inc.
Toronto, Canada
76 days
200 · 44.6s
Valid· E7, Let's Encrypt, US
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Noctua
Vendors
29/31
Status
partial
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
Technology · 6/3/2026
Noctua.paris presents branding for Noctua, but the page is currently blocked by a WAF. The scanner could not fetch the actual phishing content due to Cloudflare protection. Domain appears newly registered (76 days) with multiple third-party resources loaded; however, there is evidence of analytics posts and unusual external script load. No definitive credential harvesting form detected in the static HTML, and the page content in the visible render does not clearly show impersonation of another brand.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: Yes
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 126
Hosts: 14
Domains: 13
Suspicious Endpoints
hxxps://noctua[.]paris/assets/TelegramPromotion-DWDmQ1ez.js
hxxps://noctua[.]paris/api/analytics/hit
hxxps://noctua[.]paris/
No suspicious indicators identified
The scanner was blocked by a WAF (Cloudflare) while attempting to load the URL, with a blocker page shown in the screenshot. This is a strong signal of anti-scanning measures and potential attempt to evade automated detection. Domain intelligence indicates a recently registered domain under noctua.paris with legitimate SSL but no firm evidence of credential harvesting on the static page. The observed POST analytics endpoint and multiple third-party script loads suggest standard telemetry and media site functionality rather than a clear phishing construct at this moment. Given the WAF block and domain signals, treat as suspicious hosting with potential abuse risk, but no conclusive credential phishing identified from the available non-blocked data.
Monitor