dydx[.]beefy-hub[.]lol

Analysis of the domain dydx.beefy-hub.lol shows it is being used to impersonate the cryptocurrency exchange dYdX. The domain was registered on October 25, 2025 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to the IP address 142.250.185.132, which belongs to AS15169 owned by Google LLC and is geographically located in the United States. No TLS certificate is presented, leaving the site unencrypted. The HTTP response returns a page whose title is simply “Google,” providing no indication of the intended fraudulent content.

Google Safe Browsing classifies the site as a social‑engineering threat, and it appears on one external blocklist. Independent security tools have assigned a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scans report that ten of ninety‑five antivirus engines flag the domain as malicious, and the domain is also listed by PhishDestroy as a confirmed crypto‑scam. The overall threat category is identified as a crypto scam that attempts to lure victims by mimicking the dYdX brand.

The current operational status is offline, which may indicate a temporary takedown or that the site is no longer serving content. However, the infrastructure artifacts—particularly the Google‑owned IP address, lack of SSL, and low trust scores—remain indicative of a high‑risk impersonation campaign. Defenders should continue to block the domain at network and DNS layers, monitor the associated IP address for any future activation, and update endpoint protection signatures to include the observed indicators. Analysts should also watch for newly registered domains that combine “dydx” with other subdomains or similar naming patterns, as the attacker may recycle the same infrastructure for subsequent campaigns.