momentum[.]app-beefy[.]sbs

Analysis indicates momentum.app-beefy.sbs is an active generic phishing infrastructure associated with credential theft attempts. The domain is structured to resemble a legitimate service entry point, likely targeting users through fake authentication pages or redirect chains. The presence of a default 'Welcome to nginx!' page suggests a freshly deployed or minimally configured host used for staging malicious content.

Infrastructure analysis confirms multiple risk indicators. VirusTotal reports 3/95 security vendors flagging the domain. The domain was created on May 31 2026 and is registered through Dynadot LLC. It resolves to IP address 104.21.36.236 and uses SSL certificate issued by Google Trust Services / WE1. The domain appears on 1 security blocklist and is actively blocked by PhishDestroy. These signals collectively indicate low-to-moderate detection coverage but high confidence malicious classification due to corroborating blocklist and active blocking status.

If users have interacted with this domain, immediate mitigation steps are required. Users should assume credential compromise risk if any information was entered and reset affected passwords from a trusted device. Security teams should block the domain at DNS, proxy, and endpoint levels, and review logs for connections to 104.21.36.236. Additional monitoring for similar domains under app-beefy.sbs is recommended. Despite being still active, the combination of active blocking and recent creation indicates ongoing campaign infrastructure likely to evolve rapidly.