dydx[.]beefyapp[.]sbs

The domain dydx.beefyapp.sbs was registered on October 02, 2025 through Dynadot LLC and is currently listed as offline. Its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to IP address 142.250.185.196, an address owned by Google LLC (AS15169) and located in the United States. No TLS certificate was observed for the host, meaning HTTPS connections would be unencrypted or unavailable.

The page title returned by the server is "Google," providing no direct indication of the malicious payload. VirusTotal analysis shows that seven out of ninety‑five participating security vendors flagged the domain, suggesting a moderate level of detection consensus among scanners. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. The threat classification supplied identifies the site as a crypto scam that impersonates the dYdX brand, aligning with the broader category of brand impersonation.

While the domain’s offline status limits immediate exposure, the infrastructure details—particularly the use of a Google‑owned IP and Cloudflare name servers—demonstrate a typical pattern of leveraging reputable hosting to increase perceived legitimacy. Defenders should continue to monitor the domain for any re‑activation, ensure that any URL filtering solutions reference the observed IP and name server pair, and propagate the existing blocklist entry across enterprise security platforms. Threat intelligence feeds should be updated to reflect the observed detection count and the specific brand target to improve correlation with future attempts that may reuse similar naming conventions or hosting configurations.