faq-dydx-exchange-io-us[.]pages[.]dev

Analysis conducted on July 23, 2026, identifies faq-dydx-exchange-io-us.pages.dev as a high-risk phishing domain impersonating dYdX, a decentralized derivatives trading platform. The domain, registered through Cloudflare, Inc. on September 2, 2020, is currently offline with an HTTP 403 status, indicating access is restricted or blocked. Infrastructure analysis reveals the domain resolves to IP 172.66.47.123, hosted on Cloudflare's network (AS13335) in the United States, and uses Cloudflare nameservers (adi.ns.cloudflare.com, anna.ns.cloudflare.com, cody.ns.cloudflare.com, karl.ns.cloudflare.com). The page title, 'dYdX Exchange — Decentralized Derivatives & Margin Trading,' directly mirrors the branding of the legitimate dYdX platform, confirming the intent to deceive users into believing the site is authentic.

The scam type is classified as wallet/seed phishing, targeting cryptocurrency users likely through fraudulent requests for private keys or seed phrases. Google Safe Browsing flags the domain for social engineering, and it appears on at least one security blocklist (PhishDestroy). Twelve of 93 security vendors on VirusTotal have detected the domain as malicious, though the absence of additional context limits further interpretation of these detections. The domain employs HSTS, HTTP/3, and a valid SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users.

Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. While the domain is currently offline, defenders should treat any future resolution or reappearance as a potential threat. Organizations are advised to block the domain at the DNS or proxy level, monitor for related infrastructure (e.g., subdomains or newly registered lookalike domains), and alert users to the risk of wallet/seed phishing targeting dYdX. No evidence of active exploitation or additional attack vectors is available at this time.