trade-dydx-en-us[.]pages[.]dev

Analysis of trade-dydx-en-us.pages.dev shows a high‑confidence impersonation of the dYdX cryptocurrency platform. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to IP address 172.66.46.236, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented the HTTP status code 403 and the page title "Suspected phishing site | Cloudflare," indicating that Cloudflare has taken the content offline. The SSL certificate is issued by Google Trust Services under the identifier WE1, confirming the use of a valid TLS certificate despite the malicious intent.

Reputation services assign extremely low scores: Gridinsoft 0/100 and Scamadviser 1/100, and the domain appears on a single security blocklist. VirusTotal reports that eight out of ninety‑three scanning engines flagged the domain, reinforcing the malicious classification. Detected technologies include HSTS, HTTP/3, and Cloudflare’s edge services, with authoritative nameservers dawn.ns.cloudflare.com and arturo.ns.cloudflare.com.

The observed scam type is a crypto scam targeting dYdX users, though no page content has been captured beyond the generic Cloudflare warning page. Defenders should block the domain and its resolving IP at perimeter firewalls, update URL filtering and threat intelligence feeds, and monitor for additional subdomains registered under the same Cloudflare account. Continuous observation of Cloudflare‑hosted infrastructure is advised, as the attacker may reuse the same hosting environment for future impersonation campaigns.