dydx-v2[.]org

Analysis indicates that the domain dydx-v2.org, created on February 21, 2026 and registered through NiceNIC International Group Co., Limited, is being used for a crypto impersonation scam targeting the dYdX brand. DNS resolution points to IP address 104.21.86.130, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The authoritative nameservers are arnold.ns.cloudflare.com and destiny.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. HTTPS is terminated by a Google Trust Services certificate issued to the WE1 trust anchor, suggesting a legitimate‑looking TLS configuration.

HTTP traffic is served over HTTP/3, a protocol often leveraged by threat actors to improve performance and evade basic inspection. The page title returned by the server matches the official dYdX exchange wording: "DYDX - Decentralized Crypto Derivatives Exchange | Trade Perpetuals & Margin," which aligns with the claimed brand impersonation. VirusTotal scans have identified the domain as malicious in 13 of 93 security vendor engines, and it appears on at least one external security blocklist. The site has been taken offline and is currently blocked by the PhishDestroy mitigation service.

While the exact malicious payload or page content cannot be confirmed because the site is offline, the convergence of brand‑specific page metadata, Cloudflare hosting, a valid TLS certificate, and multiple vendor detections supports a high confidence assessment of a crypto‑related impersonation campaign. Defenders should add dydx-v2.org to network and endpoint blocklists, monitor traffic to the hosting IP 104.21.86.130 for any other suspicious activity, and consider reviewing related domain patterns that share the same registrar or nameserver configuration. Continuous re‑evaluation is recommended in case the site reappears or new indicators emerge.