soph[.]beefyapp[.]lol

The domain soph.beefyapp.lol was created on October 5, 2025 and is registered through Dynadont LLC. It resolves to the IP address 192.178.155.105, which is announced by AS15169 Google LLC and geolocated to the United States. No SSL certificate is presented, indicating that the site is served over plain HTTP. The page title returned from the host is "Google", matching the declared brand target of Google and confirming the classification as a brand impersonation attempt. Infrastructure analysis shows the domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for fast‑flux or proxy infrastructures used by threat actors.

The site has been listed on a single security blocklist, PhishDestroy, and the blocklist entry indicates that the domain is currently taken offline. VirusTotal scans have recorded 14 detections out of 95 security vendors, providing independent confirmation of malicious intent. Independent trust‑rating services assign a Gridinsoft score of 0 out of 100, further underscoring a lack of legitimacy.

While the exact payload or credential‑capture mechanisms have not been publicly disclosed, the combination of a Google‑related page title, absence of TLS, and multiple vendor detections points to a typical brand‑impersonation campaign aimed at harvesting user credentials or redirecting victims to malicious content. Defenders should proactively block the domain at DNS resolvers, update web‑filtering rules to include the associated IP range, and monitor for outbound connections to 192.178.155.105. Continuous re‑evaluation is advised in case the infrastructure is resurrected or re‑hosted under a different IP address, given the low cost of domain renewal and the use of reputable registrar and CDN services that can obscure attribution.