bafybeide2or56pa7ot4fc3wzsnuly2o32jzzgwycgjfke2pufavlxrbyy4[.]ipfs[.]dweb[.]link

This domain, bafybeide2or56pa7ot4fc3wzsnuly2o32jzzgwycgjfke2pufavlxrbyy4.ipfs.dweb.link, is identified as a high-risk brand impersonation threat targeting the dYdX trading platform. The domain was created on February 24, 2017, and currently resolves to the IP address 209.94.90.2. The page title found is 'dYdX - Trade Perpetuals on the most powerful trading platform,' which closely mimics the legitimate dYdX website, potentially leading users to believe they are interacting with the genuine platform. Analysis indicates that 12 out of 95 security vendors on VirusTotal flag this domain, and it has a ScamAdviser trust score of 1 out of 100, further confirming its malicious nature. The domain is registered through CSC Corporate Domains, Inc., and uses a Let's Encrypt SSL certificate, which is common among both legitimate and malicious sites but does not provide any additional security in this context. The infrastructure analysis reveals that the domain is protected by Cloudflare and uses HTTP/3, which could be an attempt to appear more credible to unsuspecting users. The domain appears on two security blocklists, including ScamSniffer and PhishDestroy, indicating that it has been actively involved in malicious activities. Defenders should immediately block this domain to prevent users from accessing it and falling victim to potential scams. Given the high risk and active status, it is crucial to monitor any related IP addresses and domain names for further signs of malicious activity. Additionally, users should be educated to verify the URL and SSL certificate of the dYdX website before engaging in any transactions or providing personal information.