dydx[.]moe

This domain, dydx.moe, is identified as a brand impersonation threat targeting dYdX, a decentralized cryptocurrency exchange. Analysis indicates the domain was designed to mimic legitimate dYdX infrastructure, likely to facilitate fraudulent activities such as credential theft or cryptocurrency drainer schemes. No specific drainer kit signatures were confirmed, but the domain's structure and timing align with known cryptocurrency phishing campaigns observed in recent months. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, a registrar frequently exploited for malicious operations. The domain resolves to the IP address 209.182.238.142, hosted under AS29802 (HIVELOCITY, Inc.) in Germany. Detection metrics show 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The SSL certificate is issued by Let's Encrypt (R3), a common choice for both legitimate and malicious domains due to its accessibility. No Google Safe Browsing (GSB) detections were reported at the time of analysis. The domain is currently offline, having been taken down following detection by security systems. Despite its inactive status, residual risk remains for users who may have interacted with the domain prior to its removal. Organizations and individuals are advised to monitor for unauthorized transactions or account access attempts linked to this domain. Blocking the IP address 209.182.238.142 and implementing domain-based filtering for dydx.moe in security policies is recommended to mitigate further exposure.