DNS/TLS lookup to .vu TLD domain (NovaCookies infrastructure)

Arnold Chan@slaz

•updated Aug 27, 2026•0•0•3

Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.