began-dydx-trade-en-us-am5[.]pages[.]dev

On July 24, 2026 the domain began-dydx-trade-en-us-am5.pages.dev was identified as a high‑risk impersonation of the dYdX platform. The site was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the IP address 172.66.44.134, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An HTTPS connection is terminated with a certificate issued by Google Trust Services (WE1), and the domain is served behind Cloudflare’s edge network, employing HSTS and HTTP/3. The nameservers listed are kayleigh.ns.cloudflare.com and josh.ns.cloudflare.com.

When accessed the server responded with HTTP status 403 and returned the page title "Suspected phishing site | Cloudflare". Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 11 of 95 scanners have flagged it as malicious. Additional reputation indicators include a Gridinsoft trust score of 0 / 100, inclusion on a single security blocklist, and a block by the PhishDestroy service. The site is currently offline, but its infrastructure remains observable.

The available evidence points to a crypto‑related scam targeting dYdX users, although the exact phishing payload and user‑interaction flow have not been captured. Defenders should continue to block the IP 172.66.44.134, add the domain to DNS‑based and URL filtering blocklists, monitor for any re‑registration attempts, and treat any traffic originating from this host as malicious. Ongoing vigilance is advised given the use of reputable hosting services that can be leveraged to host deceptive content.