usual[.]beefyapp[.]cfd

On 23 July 2026 analysts observed that the domain usual.beefyapp.cfd is currently offline. The domain was registered on 2 October 2025 through Dynadot LLC. DNS resolution points to IP address 142.250.184.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. No TLS certificate is presented for the host, meaning HTTPS connections are not available. The page title returned by the site, when reachable, was “Google”, matching the declared brand target of Google and confirming the intent to impersonate that brand.

VirusTotal recorded 13 detections out of 93 scanned security vendors, and the domain is listed on a single external blocklist. The Gridinsoft trust score is 0 out of 100, reflecting a lack of trust. The domain has been actively blocked by the PhishDestroy service. The limited visibility of the site, combined with the absence of a valid SSL certificate, suggests a low‑cost infrastructure that relies on legitimate cloud services for hosting and DNS.

While the IP address is owned by Google, the use of that address does not imply compromise of Google infrastructure; rather, the attacker likely leveraged a misconfigured or shared hosting environment. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated nameservers, and consider extending detection rules to flag any HTTP requests to the host. Because the site is offline, continued surveillance is advised to detect potential re‑use of the same infrastructure for future campaigns. Further investigation of the hosting environment and any related subdomains is recommended to fully map the threat actor’s infrastructure.