dydx7[.]com

This domain, dydx7.com, is identified as a brand impersonation threat targeting dYdX, a decentralized finance (DeFi) trading platform. Analysis indicates the site operates as a wallet drainer, designed to trick users into connecting their cryptocurrency wallets, leading to unauthorized transactions and asset theft. The domain mimics the legitimate dYdX interface, leveraging social engineering tactics to exploit users familiar with the brand. No specific drainer kit signature has been attributed, but the behavior aligns with known DeFi phishing campaigns targeting wallet credentials and private keys. Infrastructure analysis reveals the following technical indicators: the domain is registered through Gname.com Pte. Ltd. and was created on September 05, 2025. It resolves to the IP address 104.21.48.72, hosted on Cloudflare's network (AS13335, United States). The domain appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend legitimacy to phishing sites. No Google Safe Browsing (GSB) entries were reported at the time of analysis, suggesting the domain may have evaded detection in some automated systems. As of the latest assessment, dydx7.com has been taken offline, reducing immediate exposure risks. However, the domain remains registered and could be reactivated or repurposed. Users who interacted with the site prior to its takedown are advised to revoke any connected wallet permissions, transfer assets to a new wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address. The elevated risk level persists due to the potential for re-emergence and the irreversible nature of cryptocurrency transactions once assets are drained.