beefy[.]airsdropsalerts[.]click

The domain beefy.airsdropsalerts.click has been identified as part of a brand impersonation phishing campaign targeting Gmail users. Analysis indicates the site mimics Google’s branding, as evidenced by the page title labeled 'Google,' with the intent to deceive visitors into divulging credentials or sensitive information. The domain is currently offline, though prior activity suggests it was operational during its brief existence. Technical indicators reveal the domain was registered through Dynadot LLC on November 07, 2025, and resolved to the IP address 192.178.218.103, geolocated within the United States under AS15169 (Google LLC). Despite the IP’s association with a legitimate provider, the domain itself lacks an SSL certificate, a common red flag in phishing infrastructure. Detection metrics show the domain was flagged by 10 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. The absence of encryption and the domain’s rapid inclusion in threat intelligence feeds further underscore its malicious nature. Current status confirms the domain has been taken offline, likely due to enforcement actions or infrastructure adjustments by the threat actor. However, the registration details and hosting patterns suggest potential for reemergence under similar or altered domains. Organizations and users are advised to block the domain and its associated IP at the network perimeter, while monitoring for newly registered lookalike domains using the same registrar or hosting provider. Endpoint protection solutions should be updated to include this domain in denylists, and users should be educated on recognizing brand impersonation tactics, particularly those leveraging urgency or false login prompts.