go[.]beawex[.]com

Analysis on go.beawex.com as of 2026-08-07 indicates the domain is actively used for phishing. DNS resolution points to the IPv4 address 64.7.198.11, which is the sole host observed in recent queries. The domain has been submitted to VirusTotal, where 12 of 91 scanned security engines returned a malicious classification, confirming the presence of phishing-related payloads or infrastructure. It is listed on a single external blocklist and is explicitly blocked by the PhishDestroy feed, demonstrating that at least one industry-wide mitigation source has already taken action.

The threat rating assigned by the reporting system is elevated, and the operational status is marked active, meaning the site is presently reachable and likely serving malicious content. Publicly available metadata such as registrar information, ASN, geographic location, TLS certificate details, HTTP response codes, or page title have not been disclosed, leaving those aspects of the infrastructure unverified. Consequently, defenders cannot attribute the hosting provider or infer additional attack vectors beyond the observed DNS and detection data. The lack of a disclosed page title also prevents confirmation of the specific brand or service being spoofed.

Given the confirmed malicious classification and the presence on a reputable blocklist, defensive operators should immediately deny any outbound connections to 64.7.198.11 and add go.beawex.com to internal DNS and URL filtering policies. Security information and event management (SIEM) rules should be tuned to generate alerts on DNS lookups or HTTP requests for this domain. Where possible, sinkholing the IP address can disrupt the command-and-control channel and provide additional telemetry. Continuous monitoring of VirusTotal and other threat-intel feeds is advised to capture any changes in detection count or new blocklist entries that may indicate shifts in the campaign’s infrastructure.