beaming[.]cool

Analysis indicates that the domain beaming.cool was registered on March 6, 2026, through NiceNIC International Group Co., Limited, and is currently offline. Infrastructure review reveals the domain resolves to the IP address 151.247.193.142, geolocated in France and associated with AS399486 (12651980 CANADA INC.). Nameservers point to ns1.eggywall.cc and ns2.eggywall.cc, a configuration commonly observed in phishing infrastructure. The SSL certificate is issued by Let's Encrypt (serial number prefix E8), a pattern frequently exploited by threat actors to lend superficial legitimacy to fraudulent sites. The page title, 'Immortal,' does not explicitly identify a targeted brand; however, available intelligence classifies this as a banking phishing campaign.

As of the report date, 14 of 95 security vendors on VirusTotal flag the domain, and it appears on one security blocklist. Detection by PhishDestroy further corroborates its malicious classification. No additional brand-specific artifacts or phishing kit signatures are currently documented. Defenders should treat this domain as compromised infrastructure.

The combination of offshore hosting, recently issued SSL certificates, and low detection counts suggests an attempt to evade automated filtering. Organizations are advised to block the domain, its resolving IP, and associated nameservers at the network perimeter. Given the domain's offline status, continued monitoring for reactivation or migration to new infrastructure is recommended. No evidence currently links this campaign to broader threat actor activity, though the use of shared nameservers warrants scrutiny of related domains.