0xbox[.]live

This domain, 0xbox.live, operates as an active brand impersonation scheme specifically targeting users of the dYdX decentralized exchange platform. The site presents itself as an official dYdX Foundation Telegram channel, using identical branding elements and messaging to deceive visitors into believing they are interacting with legitimate dYdX communications. Analysis of the infrastructure reveals intent to facilitate cryptocurrency theft, likely through wallet-draining scripts or fraudulent token distribution claims, given the platform's focus on crypto trading and governance tokens.

Infrastructure analysis provides multiple indicators of malicious intent. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with phishing operations. Currently resolving to IP address 188.114.97.3, the site is flagged by 9 out of 95 security vendors on VirusTotal and appears on two independent security blocklists. Additional technical indicators include the use of Cloudflare hosting, HTTP/3 protocol implementation, and a Google Trust Services SSL certificate, which collectively suggest an attempt to mimic legitimate financial service infrastructure while maintaining operational security.

Users who have visited 0xbox.live should immediately revoke any wallet connections made through the site and monitor their accounts for unauthorized transactions. Any cryptocurrency assets or NFTs approved through this domain should be considered compromised, particularly if wallet permissions were granted. Affected users are advised to transfer remaining assets to a new wallet using a clean device, as malware may have been deployed during the interaction. Security teams should update blocklists to include this domain and its associated IP address, while monitoring for similar registration patterns using the NiceNIC registrar and Cloudflare hosting combination.