novawallet[.]co[.]uk

The domain novawallet.co.uk has been identified as a phishing site specifically targeting cryptocurrency users through brand impersonation. Analysis confirms it mimics Bitcoin wallet services, presenting itself as a legitimate platform for managing digital assets such as Bitcoin, Ethereum, and USDT. The domain is currently offline, but prior activity indicates a deliberate attempt to deceive users into disclosing sensitive credentials or transferring funds to malicious wallets. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on April 18, 2026, resolving to the IP address 35.214.102.34. It employs a Let's Encrypt SSL certificate and operates on a WordPress stack with MySQL, PHP, and Nginx technologies. Security vendors have flagged the domain in 3 of 95 VirusTotal scans, while Gridinsoft assigns it a trust score of 0/100. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The page title, "Nova Wallet® – VSol, Bitcoin, VDM, ETH, USDT, DOGE," explicitly lists cryptocurrencies to lure victims. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and registration details suggest potential for re-emergence under a similar guise. Organizations and individuals are advised to block the domain and associated IP (35.214.102.34) at the network level. Users who interacted with the site should assume credential compromise and initiate password resets for all cryptocurrency-related accounts. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. Historical data from this domain should be preserved for forensic analysis in the event of future incidents.