nnullvad[.]net

Analysis of the domain nnullvad.net shows that it was created on March 21, 2025 and is registered through Web Commerce Communications Limited. The domain resolves to the IP address 104.21.16.208, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No SSL certificate is associated with the site, indicating that traffic is unencrypted. The single observed page returns the title "Just a moment..." and the domain is currently taken offline, as confirmed by the status flag.

Security telemetry indicates that nnullvad.net appears on one blocklist and was blocked by the PhishDestroy service. VirusTotal scans have resulted in two of ninety‑five security vendors flagging the domain, an early indication of malicious activity. The available evidence classifies the threat as a generic phishing campaign. While the exact phishing vector, target brand, and payload have not been disclosed, the presence on a blocklist and the vendor flags suggest that the domain was used to lure victims to a malicious page.

Defenders should continue to monitor DNS queries for 104.21.16.208 and enforce blocklist rules that include nnullvad.net. Given the lack of TLS, any attempted connections would be exposed to interception, further underscoring the need for network‑level blocking. Organizations employing web filtering should add the domain to deny lists, and incident response teams should verify that no internal hosts have communicated with the domain since its creation date. Continued observation of Cloudflare‑hosted IPs associated with phishing activity is recommended, as threat actors frequently reuse such infrastructure.