faq-dydx-trade-en-us[.]pages[.]dev

Analysis of faq-dydx-trade-en-us.pages.dev shows a high‑risk brand‑impersonation operation targeting users of the dYdX cryptocurrency exchange. The domain, created on 2020‑09‑02, resolves to the IP address 172.66.47.105, which belongs to AS13335 Cloudflare, Inc., and is served through Cloudflare’s edge network using HSTS and HTTP/3. The TLS certificate is issued by Google Trust Services (WE1), indicating the site leveraged a valid certificate to increase credibility. The page title returned by the server – “Dydx Trade — Comprehensive Guide for Crypto Traders” – explicitly references the dYdX brand, matching the reported scam type of wallet/seed phishing.

Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has already added the domain to its blocklist; overall, the domain appears on one security blocklist. VirusTotal records show that 11 of 93 scanners flag the domain, reinforcing malicious intent. Additional reputation data includes a Gridinsoft trust score of 0 / 100 and a HTTP 403 response, suggesting the site is currently taken offline.

Nameservers listed (adi.ns.cloudflare.com, dom.ns.cloudflare.com, isla.ns.cloudflare.com, karl.ns.cloud) confirm registration through Cloudflare, Inc. The combination of brand impersonation, wallet/seed phishing designation, low trust scores, and multiple security vendor detections indicates a confirmed phishing infrastructure. Defenders should continue to block the domain at network perimeter, update URL filtering and threat‑intel feeds, and monitor for any re‑hosting attempts using the same IP range or similar sub‑domains. Because the site currently returns 403, ongoing verification of content is limited; however, the existing technical footprints provide sufficient evidence for immediate mitigation.