dydx[.]beefy-hub[.]sbs

Analysis of the domain dydx.beefy-hub.sbs, observed as offline at the time of review, indicates a high‑risk brand‑impersonation campaign targeting users of the decentralized exchange dYdX. The domain was registered on 25 Oct 2025 through Dynadot LLC and resolves to the IP address 142.251.167.105, which belongs to AS15169 (Google LLC) in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both associated with Cloudflare’s DNS infrastructure. No TLS certificate is presented, leaving the site accessible only via plain HTTP, which further reduces credibility. The HTTP response currently returns an offline status, confirming that the site is no longer reachable.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal recorded 12 detections out of 95 scanned security vendors, demonstrating a moderate consensus of malicious behavior. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. Gridinsoft’s trust scoring engine assigns a score of 0 / 100, reflecting a complete lack of trust. The page title reported by the scanner is “Google”, offering no legitimate branding cues.

Evidence confirms that the domain is designed to impersonate dYdX, and the associated scam type is identified as a crypto scam. However, the exact content served before takedown—such as phishing forms or malicious payloads—has not been captured, leaving the precise attack vector uncertain. Defenders should update web‑filtering and DNS‑sinkhole policies to block resolution of 142.251.167.105 for the host name dydx.beefy-hub.sbs, enforce TLS inspection rules to detect the absence of SSL, and add the domain to internal blocklists. Continuous monitoring of Cloudflare name‑server changes and future registration attempts for similar sub‑domains is recommended, as the infrastructure suggests the threat actor may reuse the same hosting profile for additional campaigns.