If you've run across prod-s16-rosetta.nubank.com.br and wondered whether it's fake or something to worry about, here's the short answer: it's part of Nubank, one of Brazil's largest digital banks. The subdomain almost certainly handles backend services like API routing or internal tools rather than being a public website, which explains why it has no about page, favicon, or contact info. Those absences would be red flags for a consumer-facing finance site, but for a machine-to-machine endpoint they're normal.
What matters more is what the domain's signals tell us. The parent domain nubank.com.br has been registered since 2013 and is clearly owned by NU Pagamentos SA. The certificate is valid (though it needs renewal soon), the site isn't on any blacklists, and the connection uses modern encryption. The server returns a 401 to automated checks, which is a deliberate bot-blocking measure, not a sign of anything shady.
If you're concerned about whether prod-s16-rosetta.nubank.com.br is safe to interact with (for example, if an app you use connects to this address), the evidence says yes — it's a legitimate part of a reputable financial institution. Just be aware that the security headers are missing and the certificate is expiring, so the team should address those soon. But neither issue makes the site dangerous or deceptive.