defiapp[.]beefy[.]bar

The domain defiapp.beefy.bar was registered on October 01, 2025 through Dynadot LLC and is currently taken offline. Technical analysis shows the domain resolves to IP address 142.250.184.196, which belongs to AS15169 Google LLC and is located in the United States. No SSL certificate is presented, indicating the site operated without HTTPS protection. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed.

The page title returned from the live host was "Google", matching the declared brand target of Google and confirming a brand‑impersonation intent. VirusTotal scans recorded eight detections out of ninety‑five vendors, and the domain appears on at least one public blocklist. PhishDestroy has also listed the domain as blocked, and the Scamadviser trust score is 1 out of 100, reflecting extreme risk. The listed scam type is a crypto scam, though the exact payload or lures have not been captured because the site is offline and no page content beyond the title is available.

Given the association with Google's IP space, the absence of TLS, and the multiple vendor detections, security teams should proactively block defiapp.beefy.bar at perimeter defenses, update URL filtering rules, and monitor for any resurgence of the domain or similar sub‑domains. Continuous observation of Cloudflare name server changes and re‑registration attempts is advised, as adversaries may attempt to repurpose the domain after takedown. Defenders should also consider reviewing related threat intel feeds for other domains sharing the same nameservers or IP range, as the infrastructure suggests potential reuse in broader phishing campaigns targeting Google users.