bnc[.]beefyapp[.]cfd

The domain bnc.beefyapp.cfd was observed targeting the Google brand through a classic brand‑impersonation technique. Registration data indicates the name was created on 2 October 2025 via Dynadot LLC, and the zone is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to the IPv6 address 2a00:1450:4001:811::2004, which is allocated to AS15169 owned by Google LLC and geolocated to Germany. No TLS certificate was presented, implying the site was reachable only over plain HTTP.

The page title returned “Google”, matching the declared brand target. Reputation services assign extremely low scores: Gridinsoft rates the domain 0 out of 100 and Scamadviser 1 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis shows 14 of 95 scanners flag the site as malicious, and PhishDestroy has listed it as blocked. Current operational status is offline, and the site has been taken down.

While the infrastructure components—namely the Google‑owned IP range and Cloudflare DNS—are legitimate, the combination of low trust scores, multiple vendor detections, and explicit brand impersonation confirms malicious intent. Defenders should continue to block the domain at perimeter filters, update URL‑filtering lists, and monitor for any resurrection of the host under alternative names. Additional investigation should focus on any associated payloads or credential‑harvesting pages that may have been hosted before takedown, and on correlating traffic logs for connections to the IPv6 address during the active window.