dydx-tax[.]pages[.]dev

PhishDestroy has flagged dydx-tax.pages.dev as an active brand impersonation domain designed to mimic the legitimate dYdX cryptocurrency trading platform. This deceptive site leverages Cloudflare’s Pages.dev infrastructure to host a fraudulent interface aimed at deceiving users into revealing sensitive credentials or approving unauthorized crypto transactions. The infrastructure aligns with common tactics used by crypto drainers, where threat actors impersonate trusted platforms to exploit user trust and facilitate illicit fund transfers. This domain was flagged with 0 detections out of 95 VirusTotal scans as of the latest assessment. The domain resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc., a common tactic used to obscure the true origin of malicious infrastructure. Although the SSL certificate is issued by Google Trust Services—an expected feature for legitimate platforms—this should not be interpreted as a sign of safety, as threat actors often exploit trusted certificate authorities to enhance credibility. The active status of this threat indicates ongoing exposure to users. If you have visited dydx-tax.pages.dev, cease all interactions immediately and revoke any connected wallet permissions or API keys from your dYdX account. Monitor your transaction history and connected wallet addresses for unauthorized activity. Report the domain to your security team or platform administrators to aid in broader threat mitigation. Avoid entering any credentials or engaging with wallet connection prompts until the site can be independently verified as legitimate.