threshold[.]beefyapps[.]cfd

Analysis of threshold.beefyapps.cfd indicates a confirmed brand impersonation campaign targeting Google. The domain was registered on October 24, 2025, through Dynadot LLC and uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). Infrastructure resolves to IP 142.250.186.164, geolocated to the United States under AS15169 (Google LLC), though this may reflect Cloudflare proxy routing rather than direct hosting. No SSL certificate was detected at the time of assessment, increasing the risk of unencrypted credential interception.

The page title, 'Google,' directly aligns with the reported scam type of brand impersonation, though the exact content or phishing kit in use remains unconfirmed due to the domain's offline status as of July 22, 2026. Detection coverage is limited but indicative of malicious intent: the domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal records show 3 of 95 security vendors marking the domain as malicious, though this partial detection rate suggests either early-stage deployment or evasion techniques.

Gridinsoft assigns a trust score of 0/100, further corroborating the elevated risk classification. Defenders should treat this domain as a confirmed phishing asset, particularly given its alignment with Google branding and the absence of legitimate use cases. Recommended actions include blocking the domain at DNS and web proxy layers, monitoring for related subdomains or newly registered lookalikes, and reviewing logs for prior connections to 142.250.186.164 or the Cloudflare nameserver pair.