dydx[.]app-airdropalert[.]lat

This domain, dydx.app-airdropalert.lat, is assessed as a confirmed crypto scam site targeting the dYdX brand. Registered on November 10, 2025, through Dynadot LLC, the domain was flagged by 14 of 95 security vendors on VirusTotal and appears on the PhishDestroy blocklist. Infrastructure analysis reveals the domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and resolves to the IP address 142.250.181.228, associated with Google LLC (AS15169) in the United States. No SSL certificate was detected, increasing the risk of interception or manipulation of traffic.

The page title, 'Google,' does not align with the expected branding of dYdX, suggesting either misdirection or a placeholder during development. The domain is currently offline, but its prior detection by multiple security vendors and its presence on a blocklist indicate it was actively used for malicious purposes. Defenders should treat any prior resolution of this domain as a high-confidence indicator of compromise. Given the lack of SSL and the use of Cloudflare, historical traffic or cached DNS records may provide additional forensic value.

The Gridinsoft trust score of 0/100 further corroborates the malicious classification. While the exact mechanics of the scam (e.g., token drainer, fake airdrop, or wallet phishing) are not detailed in available intelligence, the domain's association with 'airdropalert' in its subdomain suggests a likely focus on fraudulent crypto giveaways. Organizations should ensure this domain is blocked at the DNS and proxy levels, and monitor for any resurgence or related infrastructure.