novawalletfixdapps[.]com

Analysis of the domain novawalletfixdapps.com indicates active infrastructure linked to crypto-draining phishing operations. Registered on April 26, 2025, through Gname.com Pte. Ltd., the domain currently resolves to IP address 188.114.97.3 and is protected by Cloudflare, as evidenced by detected technologies including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains leveraging Cloudflare services. Six of 95 security vendors on VirusTotal have flagged this domain, while it appears on five security blocklists, including Polkadot, Codeesura, PhishDestroy, Enkrypt, and BLP-Malware. AlienVault OTX records the domain in 23 threat intelligence pulses, suggesting recurring detection in malicious activity tracking. The page title 'Nur einen Moment…' is consistent with temporary or intermediate pages used in phishing redirects, though the exact content and functionality remain unconfirmed due to lack of direct analysis. The domain’s Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as part of an active crypto-draining operation, blocking resolution at the DNS level and monitoring for connections from internal assets. Given its presence on multiple blocklists and consistent detection by security vendors, this infrastructure is likely part of a broader campaign targeting cryptocurrency users. No brand-specific targeting can be confirmed from the available data, and the domain’s longevity—over a year since registration—suggests sustained malicious intent.