dydx-airdrop[.]pages[.]dev

Analysis indicates that the domain dydx-airdrop.pages.dev was registered on November 23, 2023 through Cloudflare Pages and resolves to the IP address 172.66.45.7, which is owned by Cloudflare’s edge network. The domain is presently flagged by multiple independent security services: 14 of 91 scanners on VirusTotal reported suspicious activity, and three commercial blocklists (PhishDestroy, ScamSniffer, Enkrypt) have listed it as malicious. In addition, the domain appears on three unnamed security blocklists, reinforcing the high‑risk classification.

The threat taxonomy supplied identifies the site as a crypto drainer, suggesting attempts to capture cryptocurrency credentials or private keys. No public information about the site’s SSL certificate, HTTP response codes, page title, or content has been disclosed, so the exact delivery mechanism remains unverified. Defenders should enforce outbound filtering for connections to 172.66.45.7, block the fully qualified domain name at DNS resolvers, and add the domain to internal firewall deny lists.

Ongoing monitoring of Cloudflare Pages deployments for similar patterns is advised, as the infrastructure is shared among many benign sites, making detection based on IP alone prone to false positives. Enterprises should also review any recent user reports of unsolicited crypto‑related communications that reference “dydx airdrop” and correlate them with this indicator. Given the active status and high‑risk rating, immediate remediation is recommended.