soph[.]beefyapps[.]cfd

The domain soph.beefyapps.cfd was observed as an active phishing infrastructure targeting the Google brand. Registration data shows the domain was created on 24 October 2025 via Dynadot LLC. DNS resolution points to IP 142.250.181.228, which is owned by Google LLC and advertised under ASN 15169 in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the attacker leveraged Cloudflare’s DNS service to hide the origin of the hosting. No TLS certificate was presented for the site, meaning HTTPS connections would be unavailable or would trigger certificate warnings.

The only HTML element retrieved before the site was taken offline was a page title of “Google”, confirming a direct brand impersonation attempt. Reputation services rate the domain poorly: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist where it is listed by PhishDestroy. VirusTotal scans flag the domain as malicious in five of ninety‑five antivirus engines, reinforcing the suspicion of malicious intent. The site is currently offline, limiting immediate exposure, but the infrastructure footprints suggest a reusable template that could be redeployed under a different domain.

Defenders should add the domain and its associated IP address to internal block lists, monitor for new subdomains under the same registrar or similar naming patterns, and enforce strict URL filtering for any requests to the IP 142.250.181.228 that originate from external DNS resolutions. Continuous monitoring of Cloudflare name server activity and periodic re‑scanning of the domain on multi‑engine services are recommended to detect any resurgence. Because the site employed a brand‑name page title without SSL, users are unlikely to encounter a legitimate‑looking login page, but the presence of the Google brand in the title indicates an attempt to lure credential submission.