mmt[.]beefyapp[.]sbs

The domain mmt.beefyapp.sbs was registered on 02 October 2025 through Dynadot LLC. DNS resolution points to 142.251.40.132, an address owned by AS15169 Google LLC located in the United States. The domain appears on a single public blocklist and is specifically listed as blocked by PhishDestroy. VirusTotal analysis shows that three of ninety‑five scanned scanners raised detections, indicating a modest but non‑trivial level of malicious labeling. No TLS certificate is presented for the site, and the HTTP service does not advertise HTTPS, which further reduces transport‑layer trust.

The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming that the domain is fronted by Cloudflare’s DNS infrastructure. The page title returned from the site is “Google”, matching the declared brand target of Google, and the intelligence tags the domain as an impersonation of that brand. The site’s current operational status is offline, so active verification of content is not possible at this time. Observed indicators suggest a deliberate attempt to leverage a Google‑owned IP range and a familiar brand name to increase credibility, a tactic commonly seen in brand‑impersonation campaigns.

Defenders should continue to block the domain at perimeter filters, monitor for any re‑activation, and consider adding the domain to internal blocklists. Additional scrutiny of any future DNS changes or the appearance of a TLS certificate should be performed, as an upgrade to HTTPS could be used to further legitimize the site. Because the domain resolves to a legitimate Google address, reputation‑based systems may under‑score the threat; explicit inclusion of the domain in threat‑intel feeds mitigates this bias. At present, the evidence is limited to registration, hosting, blocklist presence, and modest scanner detections, and no further payload or credential‑harvesting behavior has been observed.