appstart-dydxx[.]wixstudio[.]com

PhishDestroy identifies appstart-dydxx.wixstudio.com as a live brand impersonation campaign targeting dYdX users, a leading decentralized exchange platform in the cryptocurrency sector. This domain, registered under the WixStudio platform, is actively exploiting dYdX’s brand identity with the intent to deceive visitors into revealing sensitive credentials or connecting crypto wallets. Evidence suggests this is a preparatory phase for a crypto drainer attack, where compromised users may suffer irreversible asset theft once malicious scripts are deployed and executed.

This domain resolves to a Google Cloud IP (34.144.206.118) and holds a valid Let’s Encrypt SSL certificate to appear legitimate. Notably, VirusTotal currently reports 0 detections out of 95 security vendors, indicating this campaign has not yet been widely flagged by automated defenses. Although registration data, domain age, and blocklist status remain under investigation, the combination of a freshly launched Wix subdomain, cryptocurrency brand impersonation, and zero detections presents a significant risk. The absence of detection does not imply safety—it suggests operational stealth and potential rapid evolution in tooling.

If you visited appstart-dydxx.wixstudio.com, cease all interaction immediately and disconnect any connected cryptocurrency wallets. Do not input credentials or sign any transactions. Scan your device for malware or unauthorized browser extensions. Report the domain to your antivirus provider and to dYdX’s official security channels. Use secure DNS filtering tools like Quad9 or OpenDNS to block future access. Remain vigilant for unauthorized transactions and consider rotating wallet keys if exposure occurred.