beautifulbooze[.]com

The domain beautifulbooze.com has been identified as a high-risk phishing threat based on its current activity and historical data. Analysis indicates that the domain was created on April 27, 2026, and it has an active status, which raises suspicion given its short existence paired with known malicious attributes. The page title currently displayed is 'DEWI11 | Akses Daftar Situs Dewi 11 Terbaru Gratis Promo Bonus 50% Spesial Ramadhan 2026', hinting at engagement in deceptive promotional tactics commonly employed in phishing schemes.

Concrete evidence supports the classification of beautifulbooze.com as a phishing site. The domain is actively blocked by multiple security services, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Furthermore, it appears on four different security blocklists and has a dangerously low trust score of 0 out of 100 according to Gridinsoft. VirusTotal reports a notable flagging from 10 out of 95 security vendors, which corroborates the notion of widespread recognition of this domain's malicious intent.

Furthermore, the domain resolves to the IP address 209.124.79.166 and utilizes an SSL certificate from Let's Encrypt, which can lend a false sense of security to unsuspecting users. The underlying technology stack includes widely used platforms such as Magento, PHP, and MySQL, suggesting that the infrastructure may have been repurposed for illicit activities. Also noteworthy is its association with 23 threat intelligence pulses within AlienVault OTX, indicating that it has been cited as a threat by multiple sources.

Given these indicators, defenders are advised to implement robust monitoring and blocking measures against beautifulbooze.com. Users should be educated on the signs of phishing and encouraged to avoid engaging with this domain or any associated content. Proactive threat hunting within networks may also reveal additional attempts to exploit users based on the tactics evidenced here.