luckywave[.]co[.]com

Analysis of luckywave.co.com indicates an active infrastructure supporting a cryptocurrency brand impersonation campaign targeting Ethereum users. The domain was originally created on August 16, 1997 and remains registered through Moniker Online Services LLC, using the legacy nameservers ns1‑ns4.nic.co.com. DNS resolution points to IP address 104.21.39.37, which belongs to ASN 13335 operated by Cloudflare, Inc., and is geolocated in the United States. HTTPS is enabled with a certificate issued by Google Trust Services under the WE1 series, and the web server returns HTTP 200 responses, confirming the site is reachable.

Automated fingerprinting shows the presence of WordPress, MySQL, PHP, jQuery, Cloudflare Browser Insights, Cloudflare edge services, and HTTP/3, suggesting a standard content‑management stack behind a CDN. Threat intelligence platforms have recorded four detections out of ninety‑one vendors on VirusTotal and the domain appears on four external blocklists. It is additionally listed as blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification.

The page title “LuckyWave Nederland — bonussen, spellen en uitbetalingen” references a Dutch gambling service, yet the site explicitly impersonates the Ethereum brand, aligning with the reported crypto scam category. Current evidence does not include a visual or functional sample of the phishing content, so the exact lure mechanisms remain unverified. Defenders should treat the domain as high‑risk; recommended actions include adding the IP and hostname to network‑level deny lists, updating DNS filtering policies, and monitoring for related traffic to Cloudflare edge nodes. Continuous re‑inspection of the site’s content and correlation with any credential‑stealing activity are advised, given the active status and recent detections.