en-io-dyd-dex[.]pages[.]dev

Analysis of en-io-dyd-dex.pages.dev shows a high‑risk brand‑impersonation campaign targeting the dYdX decentralized exchange brand. The domain was registered on February 21, 2026 and resolves to IP 172.66.47.179, an address owned by AS13335 Cloudflare, Inc., indicating the use of Cloudflare’s CDN and DNS services (nameservers holly.ns.cloudflare.com and yew.ns.cloudflare.com). The site presents a valid SSL certificate issued by Google Trust Services under the WE1 chain, and the HTTP response includes HSTS and HTTP/3 headers, suggesting a modern web stack. Google Safe Browsing flags the URL for SOCIAL_ENGINEERING, and VirusTotal records 13 detections out of 93 scanners, reinforcing the malicious classification. The domain appears on at least one security blocklist and is actively blocked by MetaMask, PhishDestroy, and SEAL, indicating that security products have identified it as a threat. Defenders should immediately add the domain to outbound web filtering rules, enforce DNS sinkholing for the IP range, and monitor for any credential‑stealing activity targeting dYdX users. Continuous threat‑intel updates are recommended to track any additional infrastructure or campaign evolution.