security-dydx-trade[.]onrender[.]com

On 23 July 2026 the domain security-dydx-trade.onrender.com was observed hosting content that mimics the legitimate dYdX brand. The site resolved to the IP address 216.24.57.251, which belongs to Autonomous System AS397273 operated by Render. Geolocation places the host in the United States. The TLS certificate presented by the server is issued by Google Trust Services under the WE1 intermediate, indicating a valid certificate chain but offering no assurance of the underlying service. HTTP probing returned a 404 status code, and the page title reported by the scanner was “dYdX | Decentralized Perpetual Trading”, directly matching the official branding of the dYdX platform.

The infrastructure utilizes Cloudflare and supports HTTP/3, both of which are common for legitimate services and can obscure the true origin of the traffic. VirusTotal analysis recorded 13 detections out of 95 scanned security vendors, confirming that a minority of AV engines flag the domain as malicious. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy, reinforcing the suspicion of abuse. Registration information shows the domain was provisioned through Render Services Inc., a cloud hosting provider that frequently offers temporary sub‑domains for developers. No authoritative nameserver records were returned (NS_NOT_FOUND), limiting further DNS‑level attribution.

The combination of brand impersonation, a matching page title, and the presence on security blocklists indicates a targeted crypto‑related scam aimed at dYdX users. However, the lack of reachable content (HTTP 404) prevents verification of any credential‑harvesting or transaction‑redirect mechanisms. Defenders should continue to deny network connections to the IP 216.24.57.251, add the fully qualified domain name to internal blocklists, and monitor for any new sub‑domains issued by the same Render account.