eth[.]beefyapp[.]lol

Analysis as of July 23, 2026 indicates that the domain eth.beefyapp.lol is associated with a high‑risk brand‑impersonation campaign targeting Google. The domain was created on October 05, 2025 and is registered through Dynadot LLC. DNS resolution points to IP address 142.251.167.147, which is owned by AS15169 Google LLC and geolocated in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate is present, leaving the site unencrypted. Google Safe Browsing has flagged the domain for social engineering, and the Gridinsoft trust score is 0 out of 100, reflecting extreme malicious confidence.

VirusTotal reports that 13 of 95 security vendors have flagged the domain, reinforcing its malicious classification. The site appears on a single security blocklist and is specifically blocked by PhishDestroy. The page title returned by the host is “Google”, matching the declared brand target. The campaign status is listed as offline at the time of reporting.

While the exact payload or credential‑harvesting mechanisms have not been observed, the convergence of a low trust score, safe‑browsing flag, multiple vendor detections, and blocklist inclusion provides strong evidence of a phishing‑style brand impersonation. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and update endpoint detection rules to include the observed IP address and associated nameservers. Ongoing intelligence gathering should focus on identifying any related domains that share the same registrar or naming infrastructure.