deex-dyydx-io[.]pages[.]dev

Analysis of the domain deex-dyydx-io.pages.dev shows that it was registered through Cloudflare, Inc. on October 15 2025 and resolves to the Cloudflare edge address 172.66.44.84, which is hosted in the United States under ASN 13335. The site presents the HTTP status code 403 and advertises HSTS, Cloudflare and HTTP/3 as active technologies. The TLS certificate is issued by Google Trust Services (WE1), indicating a valid SSL chain. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the domain is explicitly linked to a brand impersonation campaign targeting the cryptocurrency exchange dYdX.

VirusTotal scans have recorded 12 detections out of 95 security vendors, and the domain appears on a single security blocklist. Additional reputation data include a Gridinsoft trust score of 0 out of 100, and the domain is currently listed as taken offline by the blocklist operator PhishDestroy. Nameservers are april.ns.cloudflare.com, brady.ns.cloudflare.com, ns.cloudflare.com, and ns2.cloudflare.com. The evidence confirms that the infrastructure is typical of Cloudflare‑hosted phishing sites, leveraging the provider’s CDN to mask the true origin and to benefit from built‑in security features such as HSTS and HTTP/3.

Uncertainty remains regarding any active payload or credential‑harvesting pages because the site returns a 403 response and no content was captured. Defenders should continue to block the domain at perimeter filters, monitor for any future resolution changes, and add the associated IP address 172.66.44.84 to deny lists where appropriate. Given the low trust score and multiple vendor detections, organizations that allow access to dYdX services should enforce strict URL validation and consider user education about the risk of forged dYdX links. Ongoing surveillance of Cloudflare‑registered domains with similar naming patterns is recommended to detect re‑use of this infrastructure.