ddyx[.]trade-webv3-connect[.]com

This domain, ddyx.trade-webv3-connect.com, is flagged as a crypto drainer phishing site designed to compromise cryptocurrency wallets. Analysis indicates the infrastructure is engineered to execute unauthorized transactions, siphoning funds from victims' digital wallets upon interaction. No direct brand impersonation is evident, but the domain naming convention suggests an attempt to mimic legitimate web3 or trading platforms to deceive users into connecting their wallets. Infrastructure analysis reveals the domain resolves to IP address 172.67.167.118, hosted on Cloudflare's network (AS13335). The domain was registered on February 21, 2026, through GMO Internet Group, Inc. d/b/a Onamae.com. It lacks an SSL certificate, increasing susceptibility to interception. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and is categorized as a high-risk threat due to its active drainer functionality. As of the latest verification, ddyx.trade-webv3-connect.com has been taken offline, likely due to enforcement actions or hosting provider intervention. Despite its current offline status, the domain remains a residual risk due to potential re-activation or migration to alternative infrastructure. Users are advised to monitor wallet activity for unauthorized transactions and verify domain authenticity before interacting with any web3 or trading platforms. Organizations should update blocklists to include this domain and its associated IP address to prevent future exposure.