vote-hyperwavefi[.]xyz

On July 24, 2026 the domain vote-hyperwavefi.xyz was observed as an offline phishing infrastructure. The domain was registered on September 27, 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare's network (AS13335) with the IP address 104.21.84.94 located in the United States. The authoritative nameservers kianchau.ns.cloudflare.com and meilani.ns.cloudflare.com resolve to the same Cloudflare edge, indicating that the attacker relied on Cloudflare’s CDN for rapid deployment and concealment. No TLS certificate was presented, leaving the HTTP service unencrypted. The only visible page element recorded by crawlers is the title “Nur einen Moment…”, which offers no further context about the payload.

The campaign is classified as brand impersonation, although the specific victim brand was not disclosed in the captured metadata. Detection signals show that the domain appears on a single security blocklist and was actively blocked by the PhishDestroy feed. VirusTotal analysis returned seven positive detections out of ninety‑five AV engines, reinforcing the malicious classification. Independent scanning by Gridinsoft assigned a trust score of zero out of one hundred, confirming the low reputation of the host. The lack of an SSL certificate, combined with the low trust score and multiple vendor detections, suggests the site was intended to harvest credentials or redirect victims without employing encryption.

Uncertainty remains regarding the exact phishing kit, the targeted brand, and whether any victim data was exfiltrated before the takedown. No evidence of additional C2 infrastructure, redirects, or payload hosting was captured. Defenders should add vote-hyperwavefi.xyz to local blocklists, monitor for any sub‑domains that may be re‑registered, and enforce strict outbound filtering for connections to the associated Cloudflare IP range.