app[.]isbeef[.]com

The domain app.isbeef.com was observed hosting a generic phishing page that employed an Airdrop scam kit. The site’s HTML title resolved to "isbeef.com", indicating that the attacker did not customize the title to match a specific brand. DNS resolution points to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated to the United States. The domain was registered on 7 November 2024 through Porkbun LLC and uses four Porkbun‑owned nameservers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com). No TLS certificate was presented, meaning the site was reachable only over HTTP.

Security reputation data show that the domain appears on a single blocklist and has been actively blocked by PhishDestroy. On VirusTotal, two of ninety‑five scanners flagged the domain, confirming malicious behavior. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The current HTTP status is offline, indicating that the phishing infrastructure has been taken down or is no longer serving content.

However, the underlying infrastructure—particularly the Amazon‑hosted IP and the Porkbun registrar—remains reusable for future campaigns. Defenders should continue to monitor the IP address and the associated ASN for re‑use, add the domain to internal blocklists, and consider proactive sink‑holing of the IP if feasible. Further verification of the blocklist entry and any available URL snapshots would improve confidence in the historical activity. Until additional evidence emerges, the domain should be treated as a confirmed phishing source targeting users with an airdrop‑related lure.