dydx-dexx-en[.]blogspot[.]com

The domain dydx-dexx-en.blogspot.com was flagged on July 12, 2026 as a high‑risk brand‑impersonation site targeting the dYdX cryptocurrency platform. The page title returned by the server is “dYdX DEX – High‑Performance DeFi Trading Platform”, which aligns with the advertised brand. The site currently returns HTTP 200 and remains active despite being listed by PhishDestroy.

Infrastructure analysis shows the domain is hosted on Google’s Blogger service and resolves to IP address 142.250.181.225, an address owned by Google LLC (AS15169) located in the United States. Authoritative nameservers are ns1.google.com through ns4.google.com, and the TLS certificate is issued by Google Trust Services under the WE2 profile, confirming the use of Google’s certificate infrastructure. Detected technologies include Blogger, Java, Python, OpenGSE, and support for HTTP/3.

Threat intelligence indicates the domain was registered through MarkMonitor, Inc. on July 31, 2000, a registrar commonly associated with legitimate brand protection services. Nevertheless, the site is flagged by three of ninety‑five VirusTotal scanners, appears on one public blocklist, and receives a Gridinsoft trust score of 0 out of 100, suggesting a high likelihood of malicious intent. The combination of brand impersonation, cryptocurrency focus, and low trust metrics justifies the high‑risk classification, although the specific payload or credential‑harvesting mechanisms have not been publicly disclosed.

Defenders should block the domain at network perimeter and DNS layers, and add the associated IP address to endpoint deny lists. Continuous monitoring of related Blogger subdomains is advised, as the same infrastructure may be reused for additional campaigns. Incident response teams should treat any interaction with the site as potentially compromised and advise users to avoid providing dYdX credentials or cryptocurrency wallet information.