sophon[.]beefyapp[.]info

Analysis of the domain sophon.beefyapp.info indicates it was actively engaged in brand impersonation targeting Google, as evidenced by the page title 'Google' and explicit classification in threat intelligence sources. The domain is currently offline, with no HTTP response detected as of July 22, 2026. Infrastructure analysis reveals the domain resolved to IP address 216.58.212.132, which is assigned to AS15169 (Google LLC) in the United States, though this does not confirm hosting by Google itself. The domain was registered through Cloudflare, Inc., but no valid nameservers were found (NS_NOT_FOUND), suggesting potential misconfiguration or deliberate obfuscation of DNS records.

Detection data is limited but consistent with phishing activity: the domain appears on one security blocklist (PhishDestroy) and was flagged by 2 of 95 security vendors on VirusTotal. No SSL certificate was present, increasing the likelihood of interception or lack of encryption in prior communications. The Gridinsoft trust score of 0/100 further corroborates the domain's malicious classification. While the exact content of the phishing page remains unanalyzed, the available evidence—including the page title and scam type designation—confirms the intent to impersonate Google.

Defenders should treat this domain as confirmed malicious for the purposes of blocking and alerting. Given its current offline status, no active threat is present, but historical logs should be reviewed for connections to 216.58.212.132 or DNS queries for sophon.beefyapp.info. The absence of nameservers and SSL suggests the infrastructure was either hastily deployed or designed to evade detection. No further details about the phishing kit, payload delivery, or victim targeting are available at this time.