beastwey[.]com

Analysis of the domain beastwey.com indicates it was actively involved in an investment scam operation, classified as generic phishing with an elevated risk level. The domain was registered on July 5, 2025, through MAT BAO CORPORATION and has since been taken offline. Infrastructure analysis reveals it resolved to the IP address 69.5.189.54, hosted under Global-Data System IT Corporation in Switzerland. The domain utilized four nameservers: ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserverhub.com.

No SSL certificate was detected, increasing the likelihood of unencrypted communications between victims and the server. Technical indicators show the domain was running on Nginx with OpenResty, a configuration often observed in phishing infrastructure due to its flexibility in handling high traffic volumes. At the time of assessment, the domain appeared on one security blocklist, and eight out of ninety-four security vendors on VirusTotal flagged it as malicious. The absence of an SSL certificate and the use of a hosting provider with a history of abuse further support the classification of this domain as part of a phishing campaign.

Defenders should treat this domain as compromised and ensure it remains blocked at the network level. Given its offline status, monitoring for re-registration or re-emergence under a similar naming pattern is recommended. No specific brand impersonation details are available from the provided data, so the exact nature of the investment scam remains unconfirmed. Organizations should correlate logs for connections to 69.5.189.54 and the listed nameservers to identify potential prior exposure.