dydx-exchange-xyz[.]pages[.]dev

Analysis on July 23 2026 identifies the domain dydx-exchange-xyz.pages.dev as a brand‑impersonation site targeting the dYdX DeFi platform. The domain was registered on February 21 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The web server presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and the connection is protected by HSTS and HTTP/3, indicating a modern Cloudflare edge configuration. The page title returned by the HTTP request is “dYdX | DeFi's Professional Trading Platform”, matching the legitimate brand name and supporting the impersonation claim.

Google Safe Browsing flags the domain for social engineering, and PhishDestroy has already added it to its blocklist. The domain appears on a single external security blocklist, and three of ninety‑three VirusTotal scanners have raised detections, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, and the HTTP response code is 403, suggesting that the content has been taken offline at the time of analysis. The listed scam type is “Crypto Scam”, although the actual payload or credential‑harvesting page has not been captured.

Current evidence does not reveal the exact landing page content or any malicious payload, so the full operational details remain unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑appearance of the host under different subdomains, and update detection signatures to include the observed TLS fingerprint, page title, and the specific IP address. Continuous re‑scanning with multi‑engine services is advised to capture any future changes to the site’s behavior.