nextwa-ve[.]com

The domain nextwa-ve.com has been identified as a fake login portal designed to harvest user credentials. Analysis indicates this is not a generic phishing attempt but a targeted impersonation of the Next Wave brand, likely aiming to deceive users into entering sensitive login information. The domain is currently offline, though prior activity suggests it was actively used in malicious campaigns before takedown measures were applied. Infrastructure analysis reveals the domain was registered on October 07, 2025, through Tucows Domains Inc. and resolves to the IP address 104.21.86.105. It is flagged by 10 of 95 security vendors on VirusTotal, with additional detections on two security blocklists. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to phishing sites. Detected technologies include WordPress, MySQL, PHP, UIKit, Swiper, jQuery Migrate, and jQuery, hosted on a platform associated with Hostinger. The domain holds a Gridinsoft trust score of 0/100, and Google Safe Browsing has classified it under the SOCIAL_ENGINEERING category. The current status of nextwa-ve.com is offline, though the infrastructure remains a potential risk for future malicious activity. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for any re-registration attempts or shifts in hosting providers. End users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if the site was visited between October 2025 and its takedown. Proactive measures include deploying indicators of compromise (IOCs) such as the domain, IP, and SSL certificate details into security monitoring tools for retrospective analysis.