ethereum-hiprex[.]com

This domain, ethereum-hiprex.com, is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the infrastructure was designed to distribute fraudulent wallet software under the guise of "Ethereum Hiprex XP" and "Ethereum Hiprex 7.0 version Pro," likely intended to harvest cryptocurrency credentials or deploy drainer malware. The page title explicitly claims official status, increasing the likelihood of successful social engineering attacks against users seeking legitimate Ethereum tools. Infrastructure analysis reveals the domain was registered on April 8, 2025, through MainReg Inc. and resolves to the IP address 212.92.105.101, hosted on AS43350 (NForce Entertainment B.V.) in the Netherlands. VirusTotal detection shows 20 out of 95 security vendors flagging the domain, while it appears on three independent security blocklists. The domain was actively blocked by multiple cryptocurrency security layers, including wallet protection systems and anti-phishing frameworks. A Let's Encrypt SSL certificate (serial E8) was deployed, providing a false sense of legitimacy to unsuspecting visitors. As of the latest assessment, ethereum-hiprex.com has been taken offline, reducing immediate exposure. However, the underlying infrastructure—including the registrar, hosting provider, and associated IP range—remains a potential vector for future malicious activity. Users who interacted with the domain prior to its takedown may still be at risk of credential compromise or malware persistence. Recommended actions include revoking any credentials entered on the site, scanning affected systems for malicious payloads, and monitoring wallet addresses for unauthorized transactions. The domain's registration details and hosting patterns suggest a pattern of rapid deployment and takedown, a common tactic in cryptocurrency phishing campaigns.