ewt[.]beefyapp[.]lol

Analysis of ewt.beefyapp.lol shows a confirmed brand‑impersonation campaign targeting Google. The domain was created on 2025‑10‑05 and registered through Dynadot LLC. DNS resolution points to 142.250.186.100, an IP address owned by Google LLC (AS15169) and geolocated in Germany. The site is served without an SSL certificate, and the HTTP response delivers a page title of "Google," matching the declared brand target. Reputation checks indicate a Gridinsoft trust score of 0 out of 100, reflecting extreme untrustworthiness.

VirusTotal recorded four detections out of ninety‑five scanned security‑vendor engines, and the domain appears on a single external blocklist. Google Safe Browsing categorises the URL as a social‑engineering threat, and PhishDestroy has already taken the site offline and added it to its blocklist. Nameserver delegation to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggests use of Cloudflare’s DNS infrastructure, a common choice for fast‑setup malicious sites.

Defenders should immediately block ewt.beefyapp.lol at perimeter firewalls, DNS filters, and endpoint protection suites. Monitoring for newly registered domains that resolve to Google‑owned IP ranges, especially those lacking TLS, can help catch similar impersonation attempts early. Continuous ingestion of threat‑intel feeds that include the four VirusTotal detections and the single blocklist entry will ensure that any resurgence or copycat domains are flagged promptly.