nufiwallet[.]app

The domain nufiwallet.app was registered on March 11, 2026 through Tucows Domains Inc. It resolves to the IP address 216.198.79.1, which belongs to ASN 16509, an Amazon Web Services network located in the United States. The site serves HTTP 307 redirects and presents a TLS certificate issued by a public certificate authority, indicating encrypted transport. Nameserver records point to three njalla‑controlled hosts: 1‑you.njalla.no, 2‑can.njalla.in, and 3‑get.njalla.fo.

Content on the site carries the title “Nufi Wallet”, a name that does not match the targeted brand but the domain is classified as a Discord impersonation. The analysis engine flags the domain as a high‑risk brand‑impersonation threat targeting Discord users, with a reported social‑media scam type. Security telemetry shows the domain appears on three blocklists and received a single positive flag from 95 scanning engines. Only one of ninety‑five antivirus vendors reported malicious behavior, but the low Gridinsoft trust score of 0 / 100 and presence on multiple blocklists outweigh the limited detection count. The domain has also been cited in two AlienVault OTX pulses, reinforcing its malicious reputation.

Defenders should block DNS resolution for nufiwallet.app and monitor outbound connections to the associated IP range. Network sensors should flag HTTP 307 responses from this host and correlate TLS certificate usage with known malicious AWS endpoints. Because the site is actively used to lure Discord users, endpoint security solutions should enforce brand‑specific URL filtering for Discord‑related traffic. Logging should capture any attempts to load the page title Nufi Wallet, as it can be used as an indicator of compromise. Continuous re‑evaluation is advised, as the domain remains active and could evolve its payload delivery mechanisms.