dydx-exchange-defi-pro-trading-platform[.]com

The domain dydx-exchange-defi-pro-trading-platform.com is currently active and has been identified as a brand‑impersonation infrastructure targeting the dYdX brand. Registration data shows the domain was created on October 10, 2025 and is registered through NiceNIC International Group Co., Limited. DNS resolution points to IP address 172.67.139.65, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The domain uses Cloudflare nameservers (terry.ns.cloudflare.com and ximena.ns.cloudflare.com) and supports HTTP/3, confirming the presence of a Cloudflare front‑end. An SSL certificate issued by Google Trust Services (WE1) is in place, and the HTTP response returns status code 200 with the page title "dYdX Exchange - Decentralized Crypto Perpetuals & Spot Trading". Threat intelligence sources indicate the site appears on one security blocklist and is blocked by PhishDestroy, while the Gridinsoft trust score is 0 / 100. VirusTotal analysis shows that 8 of 95 security vendors have flagged the domain, suggesting a moderate level of detection across scanners. The observed evidence points to a crypto‑scam operation that mimics the official dYdX service to harvest credentials or funds. At present, no additional content analysis is available beyond the page title; therefore, the exact phishing flow and payload remain unknown. Defenders should treat the domain as malicious, block network traffic to 172.67.139.65 when associated with dYdX‑related activity, and add the domain to URL filtering policies. Continuous monitoring of the IP range and Cloudflare‑hosted services for new impersonation attempts is recommended, as the infrastructure can be rapidly redeployed under the same provider.