dydx[.]app-airdropalert[.]cfd

The domain dydx.app-airdropalert.cfd has been identified as a brand impersonation threat specifically targeting the decentralized exchange protocol dYdX. This domain is currently offline, but while active, it posed a significant risk to users by attempting to mimic legitimate dYdX airdrop alerts to steal credentials or cryptocurrency. The domain was created on February 21, 2026, and its short lifespan suggests it was designed for rapid exploitation before takedown.

Technical analysis reveals that 11 out of 95 security vendors on VirusTotal flagged this domain as malicious, indicating broad detection across the cybersecurity community. The domain resolves to the IP address 142.251.167.99, and it leverages an SSL certificate issued to WR2, which may contribute to a false sense of legitimacy. Additionally, the domain appears on one security blocklist, and its page title was set to "Google"—a common tactic to evade automated scanners. Despite these red flags, the domain's risk level was assessed as elevated due to the high value of the dYdX brand and the potential for financial loss.

Given that the domain is already offline, the immediate threat is mitigated. However, users should remain vigilant against similar phishing campaigns. PhishDestroy recommends verifying any dYdX-related communications through official channels only, avoiding clicking on unsolicited links, and using security tools that block known malicious domains. If any credentials were entered on this site, they should be changed immediately and accounts monitored for unauthorized activity.