betwave[.]fun

Analysis of the domain betwave.fun, created on 21 February 2026, reveals infrastructure consistent with a brand‑impersonation phishing operation. The site presented the page title “BETWAVE | Enter the world of sport and stakes!” suggesting an attempt to lure victims interested in sports betting. The domain resolves to the IPv4 address 57.129.97.29, which is hosted by OVH SAS (AS16276) in Germany. The hosting provider and location are publicly known, and the IP appears on a single security blocklist, indicating that at least one defensive feed has flagged the address.

The TLS certificate associated with the domain is identified as “E6”, confirming that HTTPS was offered at the time of observation. The domain has been blocked by the PhishDestroy feed, reinforcing the classification as a phishing vector. VirusTotal scanned the site with 95 anti‑malware engines and reported no detections; however, the absence of detections does not constitute evidence of benign intent. The site is currently offline, and no further HTTP response details are available.

No Safe Browsing, OTX, or additional blocklist entries were observed in the collected data. Defenders should continue to block the domain and its resolving IP, monitor OVH‑hosted ranges for similar activity, and consider adding the domain to internal deny lists. Ongoing telemetry collection is recommended to detect any re‑appearance or related infrastructure, as the offline status may be temporary.