hyperliquidvietnam[.]xyz

This domain, hyperliquidvietnam.xyz, presents an elevated-risk brand impersonation threat targeting users of the Hyperliquid decentralized finance platform. Analysis indicates the site masquerades as an official Vietnamese community portal, using localized content ('Hyperliquid Vietnam - Cộng đồng DeFi hàng đầu Việt Nam') to deceive users into disclosing sensitive credentials or installing malicious software. The campaign specifically exploits regional trust by mimicking legitimate DeFi community pages, a tactic commonly observed in targeted financial fraud operations. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 25, 2025, through NAMECHEAP INC, a registrar frequently associated with phishing infrastructure. It resolves to the IP address 188.114.96.3, which is linked to Cloudflare-protected endpoints, a pattern consistent with threat actors attempting to obscure hosting origins. Detection metrics further substantiate the malicious classification: 6 of 95 security vendors on VirusTotal flag the domain, while two distinct blocklists (including enterprise-grade threat feeds) have listed it. Additional technical artifacts include the use of Google Analytics for user tracking and Let's Encrypt SSL certificates to lend superficial legitimacy. Users who accessed hyperliquidvietnam.xyz should immediately revoke any credentials or wallet connections shared with the site. Systems that interacted with the domain should undergo a comprehensive security review, including malware scans and network traffic analysis for secondary infections. Given the domain's current offline status, monitoring for re-registration attempts under similar naming conventions (e.g., localized variations of 'hyperliquid') is recommended. Organizations should update internal blocklists to include this domain and its associated IP address (188.114.96.3) as indicators of compromise.