dydx[.]airdrpsalert[.]sbs

Analysis of the domain dydx.airdrpsalert.sbs confirms its classification as a crypto scam site targeting the dYdX brand. Registered on October 22, 2025, through Dynadot LLC, the domain currently resolves to IP address 172.217.18.4, which is associated with AS15169 (Google LLC) in the United States. No SSL certificate is present, increasing the risk of unencrypted data transmission. The domain is hosted on Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting infrastructure.

Detection data indicates elevated risk: the domain is flagged by 8 of 95 security vendors on VirusTotal, blocked by PhishDestroy, and appears on at least one security blocklist. Gridinsoft and Scamadviser both assign a trust score of 1/100, further corroborating malicious intent. The page title, 'Google,' does not align with the expected branding of dYdX, suggesting either misdirection or an attempt to evade detection. The domain was taken offline as of the report date, though its prior activity and infrastructure remain relevant for threat correlation.

Defenders should treat this domain as confirmed malicious infrastructure linked to crypto scam operations. Historical resolution data, registrar details, and Cloudflare nameserver associations should be incorporated into monitoring and blocking rules. Given the absence of an SSL certificate and the use of a major cloud provider's IP space, network-level detection may require additional scrutiny of unencrypted traffic patterns. No evidence of a phishing kit or specific scam mechanics (e.g., fake token airdrops, wallet drainers) is available in the current dataset, but the domain's branding and scam classification strongly indicate financial fraud targeting dYdX users.