dydxen[.]framer[.]ai

Analysis of the domain dydxen.framer.ai indicates a brand impersonation scheme targeting dYdX, a decentralized cryptocurrency exchange. The domain, registered through CSC Corporate Domains, Inc. on January 6, 2018, currently resolves to IP 35.71.142.77, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. As of July 24, 2026, the domain returns an HTTP 404 status with the page title 'Site Not Found | Framer,' suggesting it is either inactive or intentionally taken offline following detection. Eight of 95 security vendors on VirusTotal flagged this domain, and it appears on one security blocklist, specifically PhishDestroy.

Google Safe Browsing classifies the domain under 'social engineering,' consistent with its categorization as a crypto scam. The SSL certificate, issued by Let's Encrypt (serial E8), remains valid, and the site employs Framer Sites, React, HSTS, and HTTP/3 technologies. Nameservers are hosted under AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). While the domain is currently offline, defenders should treat it as a confirmed malicious resource due to its detection history and association with cryptocurrency fraud.

Network-level blocking of 35.71.142.77 and monitoring for re-registration or DNS changes is recommended. The exact content of the phishing page is not yet analyzed, but the available indicators align with prior dYdX impersonation campaigns. No evidence suggests this domain was used for legitimate purposes.