started-dydaxx[.]wixstudio[.]com

The domain started-dydaxx.wixstudio.com has been identified as a brand impersonation threat specifically targeting dYdX, a decentralized cryptocurrency exchange. Analysis confirms this infrastructure was designed to deceive users into interacting with fraudulent swap interfaces, likely functioning as a crypto drainer to siphon digital assets. As of the latest verification, the domain has been taken offline, though residual risks may persist in cached or mirrored instances. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 11, 2026, an anomalous future date suggesting possible manipulation of registration records. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employed technologies including Wix, React, RequireJS, and Lodash. The domain was flagged by 6 of 95 security vendors on VirusTotal, appeared on three distinct security blocklists, and was blocked by PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let’s Encrypt, a common but not exclusive indicator of legitimate domains. The page title, 'Official Site® | dYdX® Swap,' directly mimics the branding of the authentic dYdX platform, reinforcing the intent to mislead users. Current status indicates the domain is offline, reducing immediate exposure. However, users who interacted with this domain prior to takedown may remain at risk of wallet compromise or unauthorized transactions. It is recommended that affected individuals revoke any connected smart contract approvals, monitor transaction histories for anomalous activity, and verify all future interactions with the official dYdX domain. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate related infrastructure for potential lateral threats. The anomalous registration date warrants further scrutiny to determine if additional domains share similar characteristics.