dydx[.]airdrpalerts[.]lol

The domain dydx.airdrpalerts.lol was registered on October 25, 2025 through Dynadout LLC and is currently listed as offline. Infrastructure analysis reveals that the domain resolves to IP address 192.178.218.147, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain is delegated to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. No SSL certificate is present, meaning the site does not support HTTPS and would deliver content over plain HTTP if accessed.

The page title returned by the server is "Google," providing no direct indication of the intended malicious content. The domain has been flagged on a single security blocklist and is explicitly blocked by PhishDestroy, confirming that at least one reputable anti‑phishing vendor has identified it as malicious. VirusTotal analysis shows that four out of ninety‑five security vendors have flagged the domain, reinforcing the suspicion of abuse. Gridinsoft's trust score of 0 out of 100 further underscores the high risk associated with this host.

The intelligence indicates the site was used for a crypto‑related scam and impersonates the dYdX brand, suggesting it attempted to lure victims into fraudulent cryptocurrency transactions. Because the domain is offline, direct observation of payloads or phishing pages is not possible, leaving the exact content and tactics employed unknown. Defenders should continue to monitor the domain and its associated IP for any re‑activation, enforce blocklist updates across perimeter defenses, and ensure that any dYdX‑related traffic is scrutinized for anomalies. Organizations using dYdX services should educate users about the lack of legitimate dYdX presence on this domain and advise against any unsolicited communications that reference it.