v3-dydx[.]cc

On 22 July 2026, the domain v3-dydx.cc was observed hosting a crypto‑related impersonation of the decentralized exchange dYdX. The site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 188.114.97.3, which is owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers rosa.ns.cloudflare.com and will.ns.cloudflare.com, and the service presents Cloudflare Browser Insights and HTTP/3 support, indicating a modern CDN configuration. The TLS certificate is identified as type E7, and the page title returned by the server is “Portfolio · dYdX”, matching the targeted brand. VirusTotal scans show three of ninety‑three security vendors flagging the domain, and the host appears on three independent security blocklists.

Additional blocking is in place from PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing and wallet protection services have taken action. The current operational status is offline, which limits immediate exposure but does not remove the underlying infrastructure. Analysis indicates that the domain was likely used to lure cryptocurrency users into a fraudulent portfolio interface, leveraging the legitimate brand name in the title to increase credibility. The presence of Cloudflare’s CDN obscures the true origin of any backend payload, and the limited number of vendor detections suggests that the malicious content may have been short‑lived or not widely distributed before takedown.

Defenders should continue to monitor the IP address 188.114.97.3 for any re‑use, enforce DNS‑level blocking for v3-dydx.cc across corporate resolvers, and add the domain to endpoint and web‑gateway allow‑list exclusions. Security teams should also audit any recent dYdX‑related credential or wallet activity for signs of compromise, especially if users reported unsolicited portfolio links.