Known malicious kithighphishing
DDEX DEX Impersonation — chunk-vendors
family: ddex-impersonation-a692
4-host operator impersonating DDEX (decentralized exchange brand): ddex319.top, ddex329.top, plus raw IP 112.213.125.56:35971. The raw-IP serving is suspicious infrastructure.
Fingerprint anchors
Provenance
Added by: analyst
Added: 2026-05-26 19:23
4 hosts. DDEX brand impersonation + raw-IP serving.
Sightings (5)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| 112.213.125.56:35971 | 1defe347… | https://112.213.125.56:35971/static/js/chunk-vendors.c9befe52.js | byte | 2026-05-24 11:55 |
| ddex329.top | 98e59fcc… | https://ddex329.top/static/js/chunk-vendors.c9befe52.js | byte | 2026-05-24 06:31 |
| ddex319.top | b112a5ab… | http://ddex319.top/static/js/chunk-vendors.c9befe52.js | byte | 2026-05-24 06:30 |
| ddex329.top | 724b97f3… | http://ddex329.top/static/js/chunk-vendors.c9befe52.js | byte | 2026-05-24 06:13 |
| ddex359.top | a1305d9c… | http://ddex359.top/static/js/chunk-vendors.c9befe52.js | byte | 2026-05-24 06:05 |