ScanMalware.com
Known malicious kithighphishing

DDEX DEX Impersonation — chunk-vendors

family: ddex-impersonation-a692
Short link:scanmalware.com/h/83

4-host operator impersonating DDEX (decentralized exchange brand): ddex319.top, ddex329.top, plus raw IP 112.213.125.56:35971. The raw-IP serving is suspicious infrastructure.

Anchors

content sha2565c520023c4fea99d1cc253cb6a7ba5fa748859dc4ca22b00b707ca33d3b60517
canonical ASTa6920bca60e00824be727cccf2dfb9974addeb91e0f7e341886d16f48a8fceed
TLSHT125F4079CB291B0A607E761F5003F220BB23B6968B40AD4D5F2B5E4D4AD79D4E6127F3C

Provenance

Added: 2026-05-26 19:23
4 hosts. DDEX brand impersonation + raw-IP serving.

Sightings (5)Atom feed

HostScanScriptMatchScanned
112.213.125.56:359711defe347…https://112.213.125.56:35971/static/js/chunk-vendors.c9befe52.jsbyte2026-03-09 04:52
ddex329.top98e59fcc…https://ddex329.top/static/js/chunk-vendors.c9befe52.jsbyte2026-02-08 05:41
ddex319.topb112a5ab…http://ddex319.top/static/js/chunk-vendors.c9befe52.jsbyte2026-02-08 00:40
ddex329.top724b97f3…http://ddex329.top/static/js/chunk-vendors.c9befe52.jsbyte2026-02-05 11:34
ddex359.topa1305d9c…http://ddex359.top/static/js/chunk-vendors.c9befe52.jsbyte2026-02-04 09:01