ethereumhiprex[.]co

This domain, ethereumhiprex.co, operates as a crypto drainer phishing site designed to impersonate the Ethereum platform. The site presents itself as an official trading application, specifically labeled 'Ethereum Hiprex 300 Official Trading App & Latest Ethereum Hiprex Ai Version 3.0,' targeting users seeking cryptocurrency trading tools. Analysis indicates the site is engineered to deceive victims into connecting their digital wallets, enabling unauthorized transactions that drain funds without consent. The use of Ethereum branding, combined with claims of an 'AI-powered' trading system, is a common tactic to exploit trust and urgency in cryptocurrency communities. Evidence supporting the malicious classification of ethereumhiprex.co includes detection by 17 out of 95 security vendors on VirusTotal, a notable indicator of suspicious activity. The domain was registered on February 21, 2026, through Key-Systems GmbH, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 212.92.105.101, hosted by NForce Entertainment B.V. (AS43350) in the Netherlands, a provider commonly linked to phishing and fraudulent operations. Additionally, the domain appears on three security blocklists, including PhishDestroy and MetaMask, further validating its malicious intent. Users who visited ethereumhiprex.co or interacted with its content should immediately disconnect any connected wallets and revoke permissions for all suspicious smart contracts. It is critical to audit wallet activity for unauthorized transactions, particularly those involving token approvals or fund transfers. If funds were compromised, victims should report the incident to relevant blockchain analytics platforms and local cybercrime authorities. To mitigate further risk, users are advised to reset passwords, enable multi-factor authentication on all cryptocurrency-related accounts, and verify the legitimacy of any trading platforms before engaging with them. Monitoring for phishing attempts via email or social media, especially those referencing Ethereum or cryptocurrency trading, is strongly recommended.