dydxdefi-trade[.]typedream[.]app

On July 24, 2026 the domain dydxdefi-trade.typedream.app was observed delivering a brand‑impersonation campaign targeting the cryptocurrency exchange dYdX. The site resolves to the Cloudflare edge address 172.67.206.36, which is associated with ASN 13335 and hosted in the United States. The TLS certificate is issued by Google Trust Services under the WE1 authority, confirming the use of Google’s public PKI. HTTP requests return a 404 status, and the page title reported by scanners reads “Home | DYDX Trade BTC, ETH & More”, indicating a deliberate attempt to lure users interested in trading digital assets.

Infrastructure analysis shows a typical modern JavaScript stack: Node.js, React, Next.js, Webpack, and Google Cloud services including Cloud Trace and Cloud CDN, all fronted by Cloudflare. The domain was registered through the Typedream platform, a low‑cost website builder, and received a Scamadviser trust score of 11 / 100, reflecting a high likelihood of malicious intent. Threat‑intelligence feeds have flagged the domain on at least one security blocklist, and Google Safe Browsing categorises it as social engineering. VirusTotal scans reported 11 positive detections out of 95 vendors, reinforcing the malicious classification.

The site has been taken offline and is listed as blocked by the PhishDestroy mitigation service. While the exact phishing kit or credential‑harvesting mechanism has not been disclosed, the combination of a brand‑specific page title, low trust score, and multiple vendor detections strongly suggests a crypto‑focused scam designed to steal funds or credentials from dYdX users. Defenders should continue to block the domain at DNS and proxy layers, monitor for any residual traffic to the associated IP address, and update detection signatures to include the observed page title and technology fingerprint. Ongoing observation is recommended to detect possible re‑hosting under different subdomains or similar Typedream‑based deployments.