sui[.]beefyapp[.]biz

Analysis of the domain sui.beefyapp.biz indicates it was actively impersonating Google as part of a brand impersonation scam. The domain, registered on October 5, 2025, through Dynadot LLC, resolved to the IP address 142.251.40.228, which is associated with AS15169 (Google LLC) in the United States. Despite the IP's legitimate hosting context, the domain exhibited multiple indicators of fraudulent activity. Infrastructure analysis reveals the use of Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. The domain lacked an SSL certificate, increasing the likelihood of unencrypted data transmission and further signaling malicious intent.

The page title was explicitly set to 'Google,' aligning with the reported brand impersonation threat type. Detection by security vendors was limited but notable: Gridinsoft assigned a trust score of 0/100, and the domain appeared on at least one security blocklist, with PhishDestroy flagging it as malicious. While VirusTotal data indicates that 6 of 95 security vendors marked the domain as suspicious, the absence of broader detection does not diminish the risk, as phishing domains often evade initial scans. The domain was taken offline by the time of this assessment, though its prior operational status and infrastructure choices remain concerning.

Defenders should treat this domain as a confirmed threat vector for Google brand impersonation. The combination of a low trust score, blocklist presence, lack of SSL, and explicit page title alignment with the targeted brand provides sufficient evidence for classification as an elevated-risk phishing domain. Organizations are advised to monitor for related infrastructure, such as similarly named subdomains or reused Cloudflare nameservers, and to update blocklists to prevent future access attempts.