dydx-trade-eng-us[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the dYdX cryptocurrency exchange platform. Analysis indicates the site was engineered to replicate dYdX’s official branding, likely for credential theft or crypto asset diversion. The domain’s infrastructure and detection metrics align with known phishing campaigns targeting decentralized finance (DeFi) users, where attackers exploit trust in familiar interfaces to execute unauthorized transactions or drain wallets. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., resolving to the IP address 172.66.44.77. It was created on October 07, 2025, and is currently offline, though its prior activity remains a concern. Google Safe Browsing has explicitly flagged the domain as phishing, while VirusTotal reports 12 out of 95 security vendors detecting malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites to appear legitimate. The domain appears on at least one security blocklist, and its page title, 'Suspected phishing site | Cloudflare,' further confirms its fraudulent nature. The combination of these indicators—particularly the VirusTotal detection rate and blocklist inclusion—demonstrates a coordinated effort to impersonate dYdX and exploit its user base. To mitigate risks associated with this brand impersonation threat, users should immediately revoke any permissions granted to suspicious domains via wallet or exchange interfaces. Organizations should add the domain and its associated IP (172.66.44.77) to network blocklists to prevent access. Users who interacted with the site should assume credential compromise and rotate passwords, enable multi-factor authentication (MFA) on all accounts, and monitor transaction histories for unauthorized activity. For crypto-specific threats, victims should revoke active wallet sessions and transfer assets to a new, secure wallet. Security teams should investigate logs for connections to the domain or IP, as these may indicate broader compromise within an environment. Given the high-risk nature of this threat, proactive monitoring for similar domains (e.g., variations of 'dydx' or 'trade') is recommended to preempt future attacks.