flx[.]beefyapp[.]sbs

The domain flx.beefyapp.sbs has been identified as a brand impersonation site specifically targeting Gmail users. This threat, now taken offline, posed as a legitimate Google login page to harvest credentials. The domain was created on October 2, 2025, and registered through Dynadot LLC. It resolved to IP address 142.250.185.132, which interestingly is associated with Google services, suggesting the attackers may have used a shared hosting environment or spoofed the IP. The site lacked an SSL certificate, a common red flag for phishing operations. Security vendor analysis on VirusTotal shows that 3 out of 95 security vendors flagged the domain as malicious, indicating moderate detection coverage. Additionally, the domain appears on one security blocklist, further confirming its malicious nature. The page title was simply "Google," designed to deceive users into thinking they were visiting the legitimate service. Given these indicators, the risk to users who may have encountered this site is elevated, as credential theft could lead to unauthorized access to Gmail accounts. Although the site is currently offline, users should remain vigilant. Anyone who may have interacted with flx.beefyapp.sbs should immediately change their Gmail password and enable two-factor authentication. Monitoring account activity for signs of compromise is also strongly advised. PhishDestroy recommends using browser-based phishing protections and verifying URLs before entering credentials.