dydx-exchh[.]cx

Analysis of dydx-exchh.cx indicates a brand impersonation threat targeting dYdX, a known cryptocurrency exchange. The domain was registered on August 8, 2025, through CentralNic Ltd and is currently offline, returning a 404 error page. Infrastructure analysis reveals the domain resolves to IP 172.67.185.109, hosted on Cloudflare's network (AS13335), a common tactic to obscure hosting origins and evade detection. No SSL certificate is present, which is unusual for legitimate financial services and increases the risk of unencrypted data transmission. Security vendor detections are notable: 15 of 95 vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist (PhishDestroy).

Gridinsoft assigns a trust score of 0/100, reinforcing the elevated risk classification. The domain uses Cloudflare nameservers (trace.ns.cloudflare.com and val.ns.cloudflare.com), which may complicate takedown efforts. While the page title is a generic 404 error, the scam type is explicitly labeled as a crypto scam in available intelligence, aligning with the impersonation of dYdX. Defenders should treat this domain as high-risk infrastructure, particularly for users of dYdX or similar crypto platforms.

The absence of SSL, Cloudflare hosting, and vendor detections are strong indicators of malicious intent. Although the domain is currently offline, historical resolution and registration details should be monitored for reactivation. Blocklisting at the DNS or proxy level is recommended, and security teams should review logs for prior connections to 172.67.185.109 or the domain itself. Further investigation into the registration details may reveal additional linked infrastructure or actors.