beefy[.]airdropsalert[.]app

Analysis shows that beefy.airdropsalert.app is an active high‑risk brand‑impersonation infrastructure targeting Google users through a crypto‑scam vector. The domain resolves to IP address 142.250.186.132, which is registered to AS15169 Google LLC and geolocated in the United States, suggesting the attackers have deliberately leveraged legitimate Google hosting to increase credibility. VirusTotal reports that 15 of 95 scanning engines have flagged the domain, indicating a notable detection consensus among security vendors. Google Safe Browsing classifies the site as a social‑engineering threat, and the domain appears on a single known blocklist managed by PhishDestroy.

The page title returned from the HTTP response is "Google", directly matching the brand target and confirming the intent to impersonate the legitimate service. No SSL certificate is present, which is atypical for a domain hosted on Google infrastructure and may be used to avoid certificate‑pinning checks. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The registrar information shows registration through Cloudflare, Inc., a common choice for fast‑flux and abuse actors due to its privacy features.

The overall threat profile is reinforced by the classification as a crypto‑scam, although no further details about the specific financial payload are available. The service is currently taken offline, but historic activity suggests that the domain was used to lure victims into fraudulent cryptocurrency transactions. Defenders should immediately block the domain at the DNS and proxy layers, add the associated IP address to deny lists, and monitor for any outbound connections to the same AS15169 range from internal hosts. Continuous observation of related domains registered via Cloudflare and periodic re‑scanning of the IP are recommended to detect any re‑use of the infrastructure.