viponchain[.]vip

Analysis of viponchain.vip indicates this domain was actively impersonating HTX, a known cryptocurrency exchange, as part of a brand impersonation phishing campaign. The domain was registered on July 4, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 185.193.125.35, hosted by Materialism s.r.l. (AS39287) in Sweden. At the time of assessment, the site was offline, though its infrastructure remained flagged by security vendors.

The page title, 'viponchain,' does not explicitly confirm the exact content served, but the domain is explicitly classified as a brand impersonation scam targeting HTX in available threat intelligence. Eleven of ninety-three security vendors on VirusTotal detected the domain as malicious, while PhishDestroy included it on a security blocklist. The domain's SSL certificate, issued under the R11 authority, provides no additional trust indicators, and Gridinsoft assigned it a trust score of 0/100.

No evidence of Safe Browsing or Open Threat Exchange (OTX) listings was provided, leaving uncertainty about broader detection coverage. Defenders should treat this domain as compromised infrastructure and monitor for re-emergence or related domains under the same registrar or hosting provider. Given the offline status, further forensic analysis of the site's content is not currently possible, but the registration and detection patterns align with known phishing operations targeting cryptocurrency users.