blockintAI · Research blog

Registered One Second Apart: The SDX Twin Broker Sites and a Bahamas Licence That Belongs to Someone Else

BlockintAI · 2026-10-20T20:00:00.000Z

BlockintAI research. The domain, DNS, registration and live-site checks were made on Tuesday, October 20, 2026, between about 7:11 AM and 7:20 AM Central Time (CT). The regulator register and the company documents were read in the same window. Times are CT unless marked UTC. Registration-record (RDAP) and certificate dates are UTC.

At 6:43:34 UTC on December 27, 2025, someone registered sdxdefi[.]com through the Singapore registrar Gname. One second later, at 6:43:35, sdx[.]agency was registered at the same registrar.

By this autumn, both names opened the same polished trading site for a broker called "SDX Markets Limited." It offered forex, crypto, stocks and ETFs, "spreads as low as 0.0 pips," and an "Open a real user" button. The footer gave a regulator, an address in Nassau and a licence number: SIA-F217.

That number is real, but it belongs to another firm. The logo is real too, and it belongs to a different company again.

On Monday, October 19, 2026, BlockintAI reported both sites. Cloudflare, which was serving sdx[.]agency, restricted access to it within an hour of our report, and by late morning the domain had gone dark. Its twin is still online as of this morning. Here is what the pair shows, and how you can run the same checks on any trading site before you send it money.

Key facts
The brand "SDX" / "SDX Markets Limited," an online broker offering CFDs on forex, commodities, crypto, stocks and ETFs
The twins sdxdefi[.]com and sdx[.]agency, both registered through Gname.com Pte. Ltd. on Dec 27, 2025, at 06:43:34 and 06:43:35 UTC
Same site Both served the same homepage file (the same SHA-256 fingerprint) and the same main code bundle. A single Let's Encrypt certificate issued on Aug 3, 2026 covered both names
Licence claimed The footer says SDX Markets Limited is "licensed and regulated by the Bahamas Securities Commission (SIA-F217)," with "Company Registration Number 177174 B," at "Sea Sky Lane, B201, Sandyport, Nassau"
Whose licence it is Pepperstone's published documents give SIA Reg. No. SIA-F217 and IBC No. 177174 B for Pepperstone Markets Limited. Pepperstone's August 2022 privacy policy gives the same Sea Sky Lane, B201 address
The register The Securities Commission of The Bahamas' list of registered securities firms (as at Sept 30, 2026) includes Pepperstone Markets Limited. It lists no "SDX Markets Limited" and no firm with "SDX" in its name
The logo "SDX" with "a SIX company" underneath. "SDX A SIX COMPANY" is a trademark filed in 2019 by SIX Digital Exchange AG, part of Switzerland's SIX Group
sdx[.]agency Reported on Oct 19, 2026. Cloudflare wrote at 7:35 AM CT: "We have restricted access to the reported URL(s)." At 11:38 AM CT its nameservers moved off Cloudflare to an empty zone. No address record since then (re-checked 7:11 AM CT, Oct 20)
sdxdefi[.]com Still live at 7:11 AM CT on Oct 20, 2026, on different infrastructure: a mayicdn[.]net delivery name pointing to 19 addresses. Same homepage file, same footer
The "recovery" echo More than 30 near-identical X posts tagged #sdxdefi since Sept 10, 2026, from accounts that promote crypto "recovery"

Twins, one second apart

Registration records (RDAP) are public, free and quick to read. For these two domains they tell most of the story on their own.

Domain Registrar Registered (UTC) Nameservers (RDAP, Oct 20) Record last changed (UTC)
sdxdefi[.]com Gname.com Pte. Ltd. 2025-12-27 06:43:34 a1.share-dns.com / b1.share-dns.net 2026-10-01 13:34
sdx[.]agency Gname.com Pte. Ltd. 2025-12-27 06:43:35 a9.share-dns.com / b9.share-dns.net 2026-10-19 16:38

Two names registered a second apart at the same registrar were almost certainly bought together.

The rest of the evidence points the same way. On August 3, 2026, Let's Encrypt issued one web certificate covering both sdx[.]agency and sdxdefi[.]com (CertSpotter issuance 16258628365). To get one certificate for both names, the requester has to prove control of both. When the two sites were captured on October 18 and 19, they served a byte-identical homepage file. The SHA-256 fingerprint begins f04e5ce9, and the server reports the file as last modified on May 30, 2026. Both loaded the same 4.6 MB application bundle, index-5e1bab98.js. That is the same file sdxdefi[.]com still serves this morning.

The browser tab says "SDX." The link-preview title in the page's code says "Coinbase-Defi."

A licence number from someone else's paperwork

Scroll to the bottom of the site and the reassurance is laid on thick. A row of award logos reads "Globally, we are awarded." A banner says "We are fully regulated by SCB. Segregate client funds in Tier 1 banks." Then the footer, as it rendered on sdxdefi[.]com at 7:12 AM CT on October 20:

© 2022 SDX Markets Limited All Rights Reserved. Company Registration Number 177174 B SIA-F217

SDX Markets Limited is located at Sea Sky Lane, B201, Sandyport, Nassau, New Providence, The Bahamas, and is licensed and regulated by the Bahamas Securities Commission (SIA-F217).

sdx[.]agency showed the same footer when it was captured on October 18.

Every detail in that footer can be checked against free public documents, and none of them belongs to SDX.

The licence and company numbers. Pepperstone, an online broker, publishes the legal documents of its Bahamas entity. Its privacy policy, updated September 2026, opens by naming the company as Pepperstone Markets Limited, with "IBC No. 177174 B" and "SIA Reg. No: SIA-F217." Its Bahamas client terms from July 2021 carry the same two numbers. The fake footer has copied both: the licence number and the company number.

The address. Pepperstone's August 2022 privacy policy, still online, gives Pepperstone Markets Limited's business address as "Sea Sky Lane, B201, Sandyport, Nassau, New Providence, The Bahamas." That is the footer's address, word for word. The regulator's own list from September 2023 puts Pepperstone Markets Limited at "Sea Sky Lane, B201 – 204 Sandyport." Pepperstone's newer documents give a different address: its September 2026 policy and the regulator's September 2026 list both show #1 Pineapple House, Old Fort Bay. The fake site copied an address its source no longer uses.

The regulator's register. The Securities Commission of The Bahamas (SCB) publishes its lists of licensees and registrants as PDF files. The current list of firms registered under the Securities Industry Act, 2024, dated "as at 30 September 2026," includes Pepperstone Markets Limited. It has no entry for SDX Markets Limited and no firm with "SDX" in its name. The SCB's register of digital-asset businesses for the same date has none either. The lists don't print licence numbers, so the number has to be matched through the licensed firm's own documents, and those say SIA-F217 is Pepperstone's.

The sponsorship. The homepage boasts: "SDX ATP Ranking Global Title Partner and Official Online Trading Partner of the ATP Tour." On May 5, 2022, the ATP and Pepperstone announced a deal making Pepperstone the ATP Tour's Official Online Trading Partner and naming partner of the "Pepperstone ATP Rankings." Someone swapped one name for another.

The code. The site's own code gives away where the text came from. The legal-documents section links to addresses like files.SDX.com/legal/SCB/SCB_Client_TCs_ROW.pdf and files.SDX.com/legal/SCB/SCB_Privacy_Policy_ROW.pdf. Those are Pepperstone's document paths with the brand name swapped in: files.pepperstone.com/legal/SCB/SCB_Client_TCs_ROW.pdf and files.pepperstone.com/legal/SCB/SCB_Privacy_Policy_ROW.pdf both open real Pepperstone PDFs. The same code links to "secure.SDX.com/register," "twitter.com/SDXFX" and "SDXgroup[.]com/en/regulated-offices." None of those sdx.com addresses exists on SIX's real domain. The code also calls its accounts "Razor" accounts, Pepperstone's own account name, and lists 1300 033 375, the phone number on Pepperstone's Australian contact page. It's a find-and-replace job on a real broker's website.

Regulators call this a clone firm: a fake that borrows a licensed firm's name, number or address so that a quick check seems to come back clean. Here the operator went one step further. It kept the real firm's licence and company numbers but put a different company name in front of them.

The logo in the header and footer reads "SDX," with "a SIX company" in small letters underneath.

SDX is the brand of SIX Digital Exchange, the digital-asset arm of SIX Group, which runs the Swiss stock exchange. On September 10, 2021, SIX announced that SDX had received approval from FINMA, Switzerland's financial regulator, to operate a stock exchange and a central securities depository for digital assets. SIX Digital Exchange AG filed the trademark "SDX A SIX COMPANY" in the U.S. on June 28, 2019 (serial 79268657). Today sdx.com forwards to SIX's digital-assets page, which describes institutional services such as issuing, settling and holding digital securities for banks and other financial institutions.

So the site uses the name and branding of a Swiss market operator, the licence number of a Bahamas-licensed broker, and the address that broker used to have. Each piece sounds credible on its own. Put side by side, they don't fit together.

The SDX name has been borrowed before. On August 13, 2024, the Dutch markets regulator, the AFM, warned consumers about "Six Digital Exchange (kloon)" ("kloon" is Dutch for "clone"), a suspected boiler room at sixdigitalexchange[.]com. Norway's Finanstilsynet republished that warning. Neither names the SDX twins. It does show that the brand is a known target.

One door closes

BlockintAI reported both domains on the morning of October 19, 2026. At 6:44 AM CT we filed Cloudflare's abuse form for sdx[.]agency, which Cloudflare was serving at the time. At 6:58 AM CT, sdx[.]agency was still serving the SDX site.

At 7:35 AM CT, 51 minutes after the form was filed, Cloudflare replied:

We have restricted access to the reported URL(s).

The same reply named the host behind Cloudflare as PEG TECH INC, a U.S. hosting provider, and said the report had been forwarded to the site owner and to the host.

Four hours later the domain itself moved. At 11:38 AM CT (16:38 UTC), the registration record for sdx[.]agency was changed. Its nameservers, which on October 18 had been Cloudflare's, now pointed to a9/b9.share-dns, the same DNS service sdxdefi[.]com uses. The zone on those nameservers contains no address record. Since then, Google's and Cloudflare's public DNS resolvers have returned no address for sdx[.]agency or www.sdx[.]agency, so a browser has nowhere to go. That was still the case at 7:11 AM CT today.

There is no registrar hold on the domain. Its status is the routine "client transfer prohibited," and the registration runs until December 27, 2027. Cloudflare's restriction came within an hour of the report, and the move to an empty zone came later the same day. Because the registration itself is intact, the name could be pointed at a working server again at any time.

The other door is still open

sdxdefi[.]com is set up differently. It doesn't use Cloudflare's nameservers, and its responses carry none of the headers Cloudflare's website proxy adds, although public routing data shows its address blocks are announced through Cloudflare's network. It is served through a content-delivery name, 97jbska6.mayicdn[.]net, which resolved this morning to 19 addresses in four blocks. Their registration records name four small network companies: Dream Cloud Innovation Pte. Ltd. (Singapore), Cloudify Ltd., World W3B LLC and Databits LLC. All four list abuse contacts at the same domain, 1dns.cc. The mayicdn[.]net domain was itself registered at Gname on September 25, 2025.

At 7:11 AM CT on October 20, 2026, sdxdefi[.]com returned the SDX site (HTTP 200, page title "SDX") with the same homepage fingerprint it had on October 18 and the same footer claiming SIA-F217. Its registration record hasn't changed since October 1, 2026, and it carries no hold.

A twin on separate infrastructure means that reporting one name, or one hosting provider, doesn't take down the other.

The "recovery" echo

Search X for "sdxdefi" and most of what comes up is advertising. Since at least September 10, 2026, more than 30 posts tagged #sdxdefi or #SDXDeFi have appeared from accounts that promote crypto "recovery." The wording barely changes: "may involve high-risk financial activities where delayed withdrawals, unexpected charges, and limited regulatory transparency could put users' funds at risk," or "If #sdxdefi asks for an extra deposit, tax, fee, or verification charge before processing a withdrawal… Follow and DM." On October 3, three of these accounts posted within the same second.

Those posts suggest two things. Someone expects people to search for this name after losing money. And the accounts waiting for them are offering "recovery" for a fee, which is the second scam that follows the first. Real help doesn't start with a stranger asking for an upfront fee in your DMs.

How to check a licence yourself

You don't need special tools. Every check below is free and takes a few minutes.

  1. Copy exactly what the site claims. Write down the company name, the regulator, the licence number and the address from the footer or the "Regulation" page. Here: "SDX Markets Limited," Securities Commission of The Bahamas, SIA-F217, 177174 B, Sea Sky Lane, B201, Sandyport.
  2. Go to the regulator's own website. Type the address yourself. Don't click the site's link. For the Bahamas, that's scb.gov.bs, then "Registrant Licensee Status Search," which leads to the current lists of licensees and registrants. Search the PDF for the company name. If "SDX Markets Limited" isn't there, stop.
  3. Search the licence number on its own. If the number turns up in another firm's documents, as SIA-F217 does in Pepperstone's, you're looking at a clone. A real firm's number appears with that firm's name.
  4. Check the address and contact details against the regulator's entry, not the website's. Clone sites often copy an old address. This one copied an address Pepperstone no longer uses.
  5. Use IOSCO's I-SCAN (iosco.org/i-scan) and your own national regulator's warning list to search for the brand and the domain. A clean result doesn't make a site safe. A warning means walk away.
  6. Contact the real firm through details from the regulator's register, not from the site, if you think a licensed company might really be behind it.

How to check a domain's age

A broker that says "© 2022" and claims a global tennis sponsorship shouldn't be using a web address registered last winter.

  1. Look up the registration record. Go to lookup.icann.org and enter the domain, or open https://rdap.org/domain/ followed by the domain name in your browser. Find the "registration" event. For sdxdefi[.]com it shows 2025-12-27 06:43:34 UTC.
  2. Compare it with the story. Founding dates, "years of experience," awards and sponsorships that are older than the domain are a red flag. The age on its own proves nothing. A real firm can launch a new domain. But a young domain plus borrowed credentials is a clear pattern.
  3. Look at the certificate history. crt.sh (search the domain name) and CertSpotter list every public web certificate for a domain. When one certificate covers two unrelated-looking names, as it did here on August 3, 2026, the same party proved control of both.
  4. Watch for twins. Search the brand plus other endings (.com, .agency, .net, .top and so on). Fake brokers often keep spare domains, so a site that "moved" may simply have switched to a twin.

Red flags in the SDX playbook

  • A licence number that comes with someone else's name. Always check the number at the regulator and in the licensed firm's own documents.
  • A famous brand on an unfamiliar web address. A real company uses its own domain. SIX's is six-group.com, and sdx.com forwards there.
  • Sponsorships and awards you can't tie to the name. The ATP partnership on this site is Pepperstone's.
  • A new domain with an old story. sdxdefi[.]com was registered on December 27, 2025. Its footer says © 2022.
  • A site that "moves." If a platform tells you to use a new address because the old one is "under maintenance," check the new one from scratch.
  • Withdrawal fees, taxes or "verification charges." That's a common ending for fake brokers. Paying doesn't release anything.
  • "Recovery" offers. Anyone who contacts you, or tells you to DM them, offering to get your money back for a fee is running the next scam.
  • Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. In the Bahamas, contact the Securities Commission. Elsewhere, report to your national regulator and police cybercrime unit. Gname, the registrar of both domains, takes abuse reports through its web form at gname.com/abuse. If you've been scammed, you can also file a report at blockint.ai with the website, chat names, deposit addresses and transaction hashes. It's free, and anonymous reports are accepted. Keep the exact web address you used and every deposit instruction you were given. Investigators need them.

Sources

Regulator registers and warnings

The licensed firm and the brand

Domains, DNS and certificates (checked Oct 20, 2026, 7:11–7:18 AM CT)

"Recovery" posts

  • X search results for "sdxdefi" (posts from Sept 10 to Oct 18, 2026, UTC; searching X needs a free account). The accounts are not linked here