novawallet[.]xyz

The domain novawallet.xyz is a confirmed phishing site engaged in brand impersonation targeting GoDaddy users, specifically within the cryptocurrency sector. It operates as a scam designed to deceive victims into believing they are interacting with a legitimate GoDaddy service, though no drainer kit was detected. As of the latest assessment, novawallet.xyz has been taken offline, but prior activity classified it as an elevated-risk threat.

Technical indicators confirm the malicious nature of novawallet.xyz. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Forcepoint ThreatSeeker and SOCRadar, while appearing on 1 security blocklist (PhishDestroy). It was registered through Alibaba Cloud Computing Ltd. d/b/a HiChina on March 30, 2022, and resolved to the IP address 23.48.205.13, hosted on Akamai Technologies infrastructure in Germany. The SSL certificate was issued by GoDaddy.com, Inc., and the site employed technologies such as Node.js, Express, and Akamai. The page title displayed as 'novawallet.xyz', and nameservers were ns1.afternic.com and ns2.afternic.com.

Victims of novawallet.xyz should take immediate action to mitigate risks. Since the scam targeted cryptocurrency users, affected individuals should revoke any token approvals granted to suspicious contracts and transfer remaining funds to a new wallet. For credential phishing, change passwords on all accounts where the same credentials may have been reused, enable two-factor authentication, and monitor accounts for unauthorized activity. Report the domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to assist in broader takedown efforts.