signin-hyperwave[.]com

The domain signin-hyperwave.com has been identified as a brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis confirms this domain was designed to deceive users into believing they were accessing legitimate Aave authentication portals, a tactic commonly employed to harvest credentials or distribute malicious payloads. The domain is currently offline, though its infrastructure and historical activity warrant further scrutiny. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on October 29, 2025, and resolved to the IP address 188.114.97.3. It was flagged by 2 of 95 security vendors on VirusTotal, indicating early detection by a subset of the security community. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, reflecting its high-risk classification. Technologies detected include Cloudflare for content delivery and DDoS mitigation, alongside HTTP/3 for optimized performance, while its SSL certificate is issued by Google Trust Services, a legitimate but frequently abused certificate authority in phishing campaigns. Current status confirms the domain has been taken offline, likely due to enforcement actions or the operator’s decision to cease activity. However, the technical indicators associated with this domain—such as its recent registration, use of Cloudflare, and impersonation of a high-value financial target—suggest it may reappear under a different domain or infrastructure. Organizations and users are advised to monitor for similar domains using the same registrar, IP range, or certificate authority. Blocking the resolved IP (188.114.97.3) at the network level and implementing DNS-based filtering for domains registered through NiceNIC can mitigate future risks. Additionally, security teams should review logs for connections to this IP or domain to identify potential prior exposure.