dydx-trades[.]online

Analysis of the domain dydx-trades.online indicates a confirmed brand-impersonation threat targeting dYdX, a decentralized cryptocurrency exchange. Registered on August 16, 2025, through HOSTINGER operations, UAB, this domain currently resolves to an IPv6 address (2600:1901:0:84ef::) hosted on Google LLC's infrastructure (AS396982). The site was operational until recently, presenting a page title unrelated to cryptocurrency: 'Professional Cleaning and Maintenance Services | dydx.' This mismatch between the domain name and page content raises immediate red flags, as legitimate dYdX services would not associate with cleaning services. No SSL certificate was detected, increasing the risk of unencrypted data transmission.

Security vendors have flagged the domain, with three out of 95 engines on VirusTotal identifying malicious activity. Additionally, the domain appears on at least one security blocklist and is blocked by PhishDestroy. The use of DNS-parking nameservers (ns1.dns-parking.com, ns2.dns-parking.com) is atypical for a legitimate financial service and aligns with known phishing infrastructure patterns. While the domain is currently offline, defenders should treat it as an active threat vector.

Organizations are advised to block the domain at the DNS and firewall levels, monitor for related subdomains or IP associations, and alert users to the impersonation risk. Given the domain's registration age and recent takedown, threat actors may attempt to re-deploy it or spin up similar domains. No concrete evidence links this domain to a specific scam kit or payload, but the combination of brand impersonation, unrelated page title, and hosting on a major cloud provider suggests a deliberate attempt to deceive users into disclosing credentials or transferring cryptocurrency.