cetus[.]beefy[.]bar

Analysis of the domain cetus.beefy.bar indicates a brand‑impersonation campaign targeting Google. The site was registered on October 01, 2025 through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is present, and the HTTP service is currently offline, confirming the “taken offline” status reported by PhishDestroy. DNS resolution points to IP address 142.250.185.100, which belongs to AS15169 Google LLC and is geolocated in the United States.

This IP association suggests the domain was pointing to infrastructure owned by the legitimate brand, a technique often used to increase perceived trust. The page title returned by the server is “Google,” matching the declared brand target. The domain appears on one security blocklist and has been flagged by five of ninety‑five VirusTotal scanners, providing modest but concrete detection evidence.

The lack of an SSL certificate, the recent registration date, and the offline status limit visibility into the actual content served, leaving the exact phishing payload unknown. Defenders should continue to block cetus.beefy.bar at network perimeter and DNS layers, monitor for any re‑activation of the domain, and update threat‑intel feeds with the observed indicators. Additional scrutiny of traffic to the associated IP range is advised, as legitimate Google services share the same address space and could be abused in future impersonation attempts.