blockwave-miners[.]com

blockwave-miners.com was registered on May 11, 2026 through Hosting Concepts B.V. d/b/a Registrar.eu. The domain is actively hosting a site that displays a “Human verification” page and returns HTTP 302 redirects. Its primary threat is brand impersonation of the Aave cryptocurrency platform, as indicated by the page content and the classification as an impersonation scam. Infrastructure analysis shows the domain resolves to IP 198.251.84.200, which is geo‑located to Luxembourg and associated with the entity FranTech Solutions. The server presents a Let’s Encrypt R12 TLS certificate, reflecting a recently issued, automatically‑renewed certificate. Authoritative name servers are ns5.asurahosting.com and ns6.asurahosting.com, and the MX record points to blockwave-miners.com with priority 0, suggesting the domain may also be used for email abuse. Threat intelligence flags the domain on a single security blocklist and records a Gridinsoft trust score of 0/100, the lowest possible rating. PhishDestroy has already blocked the domain, confirming it as a malicious actor. The HTTP 302 response combined with the “Human verification” title is a typical tactic used to bypass automated scanners and lure users into credential harvesting pages. Although a recent VirusTotal scan returned 0/95 detections, the absence of detections does not imply benign intent. Defenders should add 198.251.84.200 and blockwave-miners.com to network and email deny lists, and monitor DNS queries for the associated name servers. Because the domain may be leveraged for credential‑stealing flows targeting Aave users, security teams should update URL filtering policies to block any URL containing blockwave-miners.com. Continuous re‑scanning of the IP and domain is advised to capture any future malicious payloads or changes in hosting infrastructure.