novapulses[.]world

This domain, novapulses.world, is flagged as a brand impersonation threat specifically targeting Discord users. Analysis indicates the domain operates as a crypto drainer, likely using a malicious kit to harvest credentials or trick users into connecting wallets. The page title, Shade Network — The Private Execution Layer, suggests a fabricated service designed to resemble a legitimate Discord feature or add-on, luring victims into interacting with a deceptive interface. Infrastructure analysis reveals the domain is hosted on IP 188.114.97.3, which resolves through Cloudflare, leveraging Node.js, React, Next.js, and Webpack for a sophisticated front-end. The SSL certificate is issued by Google Trust Services, adding a false veneer of legitimacy.

Technical indicators are consistent with a high-risk phishing operation. VirusTotal reports 4/95 security vendors flagging the domain, with additional detection in AlienVault OTX via one threat intelligence pulse. The domain is registered through NameCheap, Inc., created on October 15, 2025, and is blocked by MetaMask, SEAL, and PhishDestroy. It appears on 3 security blocklists, and Gridinsoft assigns a trust score of 0/100, confirming malicious intent. The domain does not appear on Google Safe Browsing blacklists as of analysis, which is a notable gap in detection.

Current status shows the domain is offline, likely taken down by the registrar or hosting provider after threat intelligence reports. Remaining risk includes potential reactivation under similar domains or subdomains, as threat actors often use disposable registrations. Safety guidance: users should avoid any links or messages referencing Shade Network or novapulses.world, never connect cryptocurrency wallets to untrusted sites, and report any such interactions to Discord support. Monitoring for related domains with similar infrastructure patterns is recommended to preempt future attacks.