lunariswavebk[.]com[.]stableprimeinv[.]org

Lunariswavebk.com.stableprimeinv.org is a phishing domain that employs cloaking techniques to evade detection. It presents benign content to security scanners, earning a cloaking score of 2/10. Despite these evasive measures, 4 out of 91 VirusTotal vendors have flagged it as malicious, indicating its potential threat to users.

The domain is registered through Ultahost, Inc. and is hosted on an IP address located in Germany, under the same organization. This setup suggests a coordinated effort to maintain anonymity and evade detection. The domain's SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its automated and free issuance process.

PhishDestroy added this domain to its blocklist after first detecting it on June 22, 2026. The early detection highlights the effectiveness of PhishDestroy's pipeline, which identifies threats during the critical 24-72 hour window before they propagate to antivirus databases. With only one public blocklist entry, this domain remains under the radar, emphasizing the importance of proactive threat intelligence.