chillnunu[.]app

chillnunu.app was registered on 21 February 2026 and currently resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is served by three nameservers – 2-nest.pipe.ma, 1-ceci.njalla.do and 3-pas.njalla.in – which are consistent with the njalla hosting service. The site presented a single HTML title element reading “nunu”. An SSL certificate identified as “WE1” was observed, indicating the presence of TLS but providing no further validation details.

VirusTotal scans returned six positive detections out of ninety‑three participating engines, and Gridinsoft assigned a trust score of zero out of one hundred, suggesting a high confidence of malicious behavior. The domain appears on two independent phishing blocklists and has been explicitly flagged by PhishDestroy and ScamSniffer. As of the analysis date, the host is reported offline, which may be a temporary takedown or a change in operational posture. Evidence confirms the domain’s use in a generic phishing campaign, though the specific targeted brand or credential‑harvesting vector has not been disclosed.

The lack of publicly available page content beyond the title leaves the exact lure unknown, and no Safe Browsing or OTX entries were identified at the time of writing. Defenders should continue to block the domain at perimeter security appliances, update URL filtering policies, and monitor the associated IP address for any re‑appearance of malicious services. Because the underlying Cloudflare IP is shared among many legitimate services, correlation with other threat indicators is recommended before taking broader actions against the hosting provider. Ongoing reconnaissance of the nameserver hierarchy and periodic re‑scanning of the domain are advised to detect any resurgence.