zeebu[.]beefyapps[.]lol

Analysis of zeebu.beefyapps.lol indicates that the domain was created on October 24, 2025 and was registered through Dynadot LLC. The authoritative nameservers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare DNS services. DNS resolution points to IP address 172.253.62.103, which is registered to AS15169 Google LLC and geolocated in the United States. The absence of an SSL certificate means the site was served over plain HTTP, a characteristic often observed in low‑effort impersonation campaigns. The page title returned by the server is exactly "Google," matching the declared brand target of Google and reinforcing the classification as a brand impersonation attempt.

Reputation metrics show a Gridinsoft trust score of 0 out of 100, indicating an extremely low confidence rating. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis reports that 2 of 95 scanned security vendors flagged the domain, providing limited but corroborating evidence of malicious intent. The overall risk level is marked as elevated, although the site is currently offline, which may limit immediate exposure.

Defenders should continue to monitor the associated IP address and related ASN for any resurgence of activity, given that the infrastructure is tied to a legitimate cloud provider and could be reused. Blocking the domain at the DNS or network perimeter is advisable, as is adding the IP address to threat intelligence feeds. Since the site lacks TLS, any future activation would be detectable through TLS inspection mechanisms. The limited detection count suggests the campaign was either short‑lived or not widely propagated; however, the presence of brand‑specific indicators warrants inclusion in brand‑watchlists and proactive user education regarding unsolicited requests appearing to originate from Google.