zeebu[.]beefyapp[.]info

Analysis of zeebu.beefyapp.info indicates that the domain was used in a brand‑impersonation campaign targeting Google. Vantage points from VirusTotal show three of ninety‑five scanned security vendors flagged the site as malicious, confirming a detectable threat. The page title returned by HTTP requests is “Google”, matching the claimed impersonated brand. The domain resolves to the IP address 172.217.18.4, which belongs to ASN 15169, owned by Google LLC and located in the United States, demonstrating the use of legitimate Google infrastructure to lend credibility to the malicious host.

Registration details list Cloudflare, Inc. as the registrar, a common choice for fast‑flux or disposable domains. No TLS certificate is presented, meaning the site served only over plain HTTP, which is consistent with the observed lack of HTTPS protection. The Gridinsoft trust scoring system assigned a score of 0 / 100, indicating an extremely low reputation. Defensive feeds have already taken action: PhishDestroy has blocked the domain and it appears on one additional security blocklist.

Current monitoring shows the domain is offline, suggesting the operator has withdrawn the site after detection. Defenders should continue to block the domain at perimeter and DNS layers, monitor for other subdomains under the beefyapp.info zone, and watch for repeat use of the same IP address or Cloudflare registrar in new malicious registrations. Ongoing awareness messaging to users about unsolicited requests purporting to be from Google can reduce the risk of credential harvesting.