ip[.]beefyapps[.]lat

Analysis indicates that the domain ip.beefyapps.lat was registered on October 24 2025 through Dynadot LLC. The authoritative nameservers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the domain is hosted on Cloudflare DNS. DNS resolution points to IP address 142.250.181.228, which belongs to AS15169 owned by Google LLC and is physically located in the United States. The HTTP response lacks an SSL certificate, meaning the site is served only over plain HTTP. The page title returned by the web server is “Google”, aligning with the declared brand target of Google and confirming the classification as a brand‑impersonation campaign.

Gridinsoft assigns a trust score of 0 out of 100, indicating a severely malicious reputation. VirusTotal analysis shows that 2 of 95 scanning engines have flagged the domain, providing independent confirmation of malicious intent. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy feed. As of the report date (July 22 2026) the site has been taken offline, limiting immediate exposure but leaving the infrastructure footprint observable.

Defenders should continue to block the domain and its resolved IP at perimeter and DNS filters, monitor for any re‑activation, and consider adding the associated IP range to watch lists. Because the site does not present an SSL certificate, any future attempts to serve content over HTTPS would require certificate acquisition, which could be detected as an anomalous change. At present, no further content analysis is available, and the exact phishing payload or landing page structure remains unknown.