folks[.]beefyapp[.]cfd

The domain folks.beefyapp.cfd is currently offline but exhibits multiple indicators consistent with a brand impersonation operation targeting Google. The site was registered on October 02, 2025 through Dynadot LLC and resolves to the IP address 172.253.62.105, which belongs to AS15169 Google LLC and is located in the United States. No SSL certificate is presented, leaving the connection unencrypted. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare, a common choice for fast deployment of malicious infrastructure.

The page title returned by the server is "Google," directly aligning with the declared brand target. VirusTotal analysis shows that 13 out of 95 security vendors have flagged the domain, providing independent corroboration of malicious intent. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a blocked resource. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse.

While the site is not presently serving content, the combination of brand‑matching page title, lack of TLS, low trust score, and multiple vendor detections suggests it was used to lure victims into credential harvesting or other fraudulent activity. Defenders should continue to block the domain at perimeter defenses, update URL filtering and threat intelligence feeds to include the observed IP and nameserver pairings, and monitor for any re‑registration attempts. Because the domain is hosted on Cloudflare, any future re‑deployment may leverage the same nameservers, so correlation with similar Cloudflare‑based phishing infrastructure is advised. Organizations should also enforce strict verification of Google‑related communications and consider employing DNS‑based protective controls that reference the known malicious IP and domain hashes.