illuvium-wave4[.]xyz

Analysis of the domain illuvium-wave4.xyz indicates active brand impersonation targeting the Illuvium gaming or cryptocurrency platform. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to IP address 172.67.215.169, hosted on Cloudflare's infrastructure (AS13335) in the United States. The site returns an HTTP 403 status, suggesting access restrictions or a placeholder state, while the page title 'Just a moment...' is consistent with Cloudflare interstitial pages or anti-bot measures. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside nameservers arvind.ns.cloudflare.com and chan.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-protected domains. Security vendor detection is present but limited: 11 of 93 engines on VirusTotal flag the domain, and it appears on one security blocklist. The domain's Gridinsoft trust score is 0/100, reinforcing its classification as high-risk. No specific phishing kit or payload has been confirmed at this stage, and the exact content or attack vector remains unanalyzed due to the 403 response. Defenders should treat this domain as an active threat, particularly in environments where Illuvium-related services are accessed or discussed. Blocking the domain and its associated IP at the network level is recommended, alongside monitoring for user interactions or credential submissions linked to this infrastructure. Further analysis of any accessible content is necessary to determine the precise attack methodology.