ddydx-exchnge-io[.]daftpage[.]com

Analysis of the domain ddydx-exchnge-io.daftpage.com indicates active brand impersonation targeting dYdX, a decentralized cryptocurrency exchange. The domain remains operational as of July 12, 2026, resolving to IP address 216.150.1.65 within Amazon.com, Inc.'s AS16509 network, located in the United States. Infrastructure analysis reveals the domain was registered on October 24, 2021, through OVH, SAS, with nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting hosting on a platform commonly used for rapid deployment of web applications. The domain is flagged by one security blocklist and has a trust score of 0/100, with seven of 95 security vendors on VirusTotal detecting it as malicious. The HTTP status code 308 indicates a permanent redirect, though the destination is not specified in available data. Detected technologies include Node.js, React, Next.js, and Vercel, consistent with modern web applications, alongside Google Analytics and Crisp Live Chat, which may be used for tracking or social engineering. The SSL certificate is issued by Let's Encrypt, a common but not inherently suspicious provider. The page title, ddydx-exchnge-io, closely resembles the legitimate dYdX brand, with a minor misspelling likely intended to deceive users. While the exact content of the site has not been analyzed, the classification as a crypto scam aligns with known tactics of impersonating financial platforms to facilitate fraudulent transactions or credential theft. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to it. Additional investigation into associated infrastructure, such as linked wallets or redirect chains, may provide further context for mitigation efforts.