dydxtrades-dex[.]typedream[.]app

Analysis of dydxtrades-dex.typedream.app, created on 21 February 2026 and presently taken offline, shows a clear case of brand impersonation targeting the dYdX cryptocurrency platform. The domain resolves to IP 104.21.37.85, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. TLS termination is provided by a Google Trust Services certificate issued to WE1, indicating the use of Cloudflare’s SSL proxy. HTTP responses return a 403 status code, and the page title reported by the server is “Suspected phishing site | Cloudflare”.

The site’s technology stack includes Node.js, React, Next.js, Google Cloud services, Cloudflare CDN, and Webpack, suggesting a modern web application framework typical of phishing kits. Reputation signals are poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist, PhishDestroy. VirusTotal scans show eight of ninety‑three security vendors flagging the domain, reinforcing the malicious assessment. Registration was performed through Squarespace Domains II LLC, a common registrar for disposable or short‑lived domains.

While the site is offline, defenders should continue to block the associated IP address and add the domain to internal deny‑list policies. Ongoing monitoring of Cloudflare‑hosted IP ranges for similar activity is advised, as threat actors frequently reuse this infrastructure. Because the content of the site beyond the title has not been publicly captured, further forensic collection would be required to determine any credential‑ harvesting forms or malicious payloads that may have been delivered before takedown.