dymwizard[.]top

Analysis of dymwizard.top indicates the site was registered on February 21 2026 and later taken offline. DNS resolves to 104.21.32.1, an address owned by Cloudflare (AS13335) located in the United States. The domain is listed on multiple blocklists, including PhishDestroy and ScamSniffer, and appears in a single AlienVault OTX pulse, demonstrating that threat‑intel feeds have flagged it. VirusTotal scans recorded 12 detections out of 93 scanning engines, confirming malicious classification by a notable subset of vendors.

Reputation services assign extremely low scores—Scamadviser 1/100 and Gridinsoft 0/100—reinforcing the assessment of a fraudulent operation. The site presented the page title “Super Champs HQ – Token Stakes,” a phrasing commonly used in crypto‑airdrop scams, and explicitly impersonates the brand “base” as indicated by the intelligence. The scam type is recorded as a “Fake Airdrop,” suggesting attackers aim to lure victims into providing wallet credentials or transferring tokens under the pretense of a free distribution. The SSL certificate is identified only as “WE1,” which offers no indication of strong validation.

Because the site is currently offline, live content cannot be inspected, and the exact phishing workflow remains unknown. Defenders should continue to block the domain at network perimeter and DNS layers, add the associated IP address to cloud‑service deny lists, and monitor for any resurgence of the domain or similar Cloudflare‑hosted aliases. Threat‑intel teams should also correlate the observed page title and brand impersonation with other ongoing fake‑airdrop campaigns to identify shared command‑and‑control infrastructure or phishing kits. Ongoing observation of the two blocklists and the OTX pulse is recommended to capture any re‑activation.