began-dydx-trade-eng-us[.]pages[.]dev

Analysis indicates that the domain began-dydx-trade-eng-us.pages.dev was created on 27 October 2025 and is presently taken offline. The site was hosted behind Cloudflare’s network (ASN 13335) and resolved to IP address 172.66.44.94, a Cloudflare edge node located in the United States. Registration details show the domain was provisioned directly through Cloudflare, Inc., and the authoritative nameservers listed are malcolm.ns.cloudflare.com and paloma.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, and the HTTPS service enforced HSTS and HTTP/3, reflecting a modern Cloudflare configuration.

An HTTP request returned status code 403, indicating access denial at the time of inspection. Security telemetry highlights that the domain is flagged as a crypto‑related scam that impersonates the dYdX brand. Google Safe Browsing classified the site under social engineering, and PhishDestroy has added it to its blocklist. VirusTotal scans recorded detections by 10 of 95 antivirus and URL‑reputation engines, reinforcing the malicious assessment.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external security blocklist. The page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the observed classification. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any residual traffic to the associated Cloudflare IP range, and ensure that user education materials reference the dYdX brand impersonation scenario. Given the offline status, immediate remediation is limited to containment, but ongoing observation of Cloudflare‑hosted assets for similar naming patterns is advised.