learn-dydx-trade[.]typedream[.]app

Analysis of learn-dydx-trade.typedream.app shows a newly registered domain created on 21 February 2026 that is currently offline and returns a 404 HTTP status. The site was hosted behind Cloudflare (ASN 13335) and resolves to the IP address 188.114.97.3 located in the United States. SSL termination is provided by Google Trust Services under the WE1 certificate, indicating the use of Google Cloud infrastructure. Fingerprinting of the web stack reveals Node.js, React, Next.js, Google Cloud Trace, Google Cloud CDN and Cloudflare Browser Insights, all typical of modern JavaScript‑heavy applications. Registration was performed through Squarespace Domains II LLC, a known registrar for many short‑lived abuse campaigns.

The domain is explicitly listed as impersonating the dYdX brand and is classified as a crypto‑related scam. VirusTotal has recorded detections from 16 of 93 scanning engines, and the domain appears on at least one external blocklist, namely PhishDestroy, which has already blocked it. No additional threat‑intel feeds such as OTX or Google Safe Browsing were referenced in the supplied data. Given the combination of brand impersonation, a recent creation date, active detections by multiple vendors, and a hosted infrastructure that can be rapidly provisioned, the domain should be treated as a confirmed malicious actor targeting users of the dYdX platform.

Defenders should add the domain to internal block lists, update DNS filtering rules to deny resolution, and monitor for any related C2 infrastructure that may share the same IP or Cloudflare configuration. Since the site currently returns a 404 page, any future change in HTTP response should be re‑examined promptly. Analysts should also watch for new domains registered by the same registrar that contain the “dydx” keyword, as the pattern suggests an automated naming scheme. Continuous correlation with threat‑intel feeds will help capture any resurgence of the campaign.