heyna[.]trade

This domain, heyna.trade, is an active phishing domain impersonating the dYdX brand. It was registered on February 21, 2026 through NiceNIC International Group Co., Limited and uses Cloudflare infrastructure with HTTP/3. The page title is Trade | HyENA. SSL certificate is issued by Google Trust Services. The domain resolves to IP address 188.114.96.3. Threat intelligence sources indicate this is a Recovery Scam phishing kit. The domain appears on four security blocklists and is blocked by SEAL, MetaMask, PhishDestroy, and BLP-Malware. Gridinsoft trust score is 0 out of 100. AlienVault OTX shows the domain in 22 threat intelligence pulses. VirusTotal reports 5 of 95 security vendors flagging this domain. Defenders should treat this domain as a confirmed phishing threat targeting dYdX users. Immediate actions include blocking the domain at the DNS level, adding the IP to threat feeds, and monitoring for any related subdomains or infrastructure. Users who may have interacted with this domain should be warned about the Recovery Scam kit, which typically attempts to trick victims into connecting wallets or providing seed phrases under the guise of recovering funds. Given the high risk level and active status, this domain requires ongoing monitoring and should be shared with relevant threat intelligence sharing groups.