waveholdminers[.]com

Analysis indicates that waveholdminers.com is an active generic phishing domain with a high risk rating. The domain was registered on August 02, 2024 through TuringSign Inc. d/b/a Cosmotown and is served by four LyteHosting name servers (dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, dns4.lytehosting.com). DNS resolution points to the IPv4 address 163.61.236.12. VirusTotal scans show that two of ninety‑one security vendors have flagged the domain, providing early vendor‑based detection evidence.

The domain is presently listed on a single security blocklist and has been blocked by the PhishDestroy service, confirming that at least one anti‑phishing feed considers it malicious. No public evidence was found for SSL/TLS certificate details, HTTP response codes, page title, or additional threat intelligence such as OTX or Safe Browsing entries, leaving those aspects unverified. The limited detection footprint suggests the campaign may be in an early deployment stage or employing evasive hosting techniques, but the presence on reputable blocklists and vendor flags demonstrates sufficient malicious intent to warrant immediate defensive action. Defenders should add the domain and its associated IP address to network deny lists, enforce URL filtering rules that block both the exact host and its name‑server infrastructure, and monitor DNS queries for the four LyteHosting name servers.

Continuous passive DNS monitoring is advised to capture any future changes to the domain's resolution or additional hosting resources. Organizations should also ensure that email gateways inspect links to waveholdminers.com and quarantine messages containing such URLs, while endpoint protection solutions should be updated to recognize the two vendor detections associated with the domain. Given the high‑risk classification, rapid containment and ongoing observation are essential to mitigate potential credential harvesting or data exfiltration attempts.