dydxexchange[.]pages[.]dev

This domain, dydxexchange.pages.dev, is flagged as an active phishing infrastructure targeting users of the dYdX cryptocurrency exchange platform. Analysis indicates brand impersonation, with the page title explicitly mimicking the legitimate platform: "dYdX - Trade Perpetuals on the most powerful trading platform." The domain is designed to deceive users into interacting with fraudulent trading interfaces, likely leading to credential theft or unauthorized transactions. No specific drainer kit signatures have been identified at this time, but the infrastructure aligns with known phishing campaigns targeting decentralized finance (DeFi) platforms.

Technical indicators confirm the domain's malicious intent. VirusTotal reports 17 out of 95 security vendors flagging dydxexchange.pages.dev as malicious. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare's network. The domain was created on March 30, 2026, and is secured with an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing has classified the domain as phishing, and it appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

As of the latest assessment, dydxexchange.pages.dev remains active and poses a high risk to users. Immediate response actions include blocking the domain at the network level, revoking SSL certificates where possible, and notifying affected parties. Despite these measures, the domain continues to resolve, and users are advised to avoid interaction. Organizations should monitor for similar phishing domains leveraging Cloudflare Pages infrastructure and update detection rules to include the IP address 188.114.96.3 and associated indicators.