sail[.]beefyapps[.]sbs

PhishDestroy has identified sail.beefyapps.sbs as a generic phishing domain with an elevated risk level. This domain was likely designed to mimic a legitimate service, potentially a crypto drainer or fake login page, though it does not impersonate any specific well-known brand. The domain was created on October 24, 2025, and registered through Dynadot LLC, a common registrar for malicious domains. It resolves to IP address 104.21.55.81, which is associated with Cloudflare's infrastructure, adding a layer of obfuscation.

Technical indicators paint a clear picture of malicious intent. VirusTotal flags this domain with a score of 7 out of 95 security vendors, indicating moderate but significant detection. The domain appears on at least one security blocklist and lacks an SSL certificate, which is unusual for legitimate sites. The page title, 'Access denied | sail.beefyapps.sbs used Cloudflare to restrict access,' suggests the site may have been taken offline or is using Cloudflare to block direct access, a tactic often employed to evade analysis. Google Safe Browsing (GSB) status is not explicitly stated but the domain's presence on blocklists implies it may be flagged.

As of the latest scan, sail.beefyapps.sbs is offline, likely due to takedown actions or the threat actor deactivating it. However, the risk remains elevated because similar domains may still be active. Users should avoid visiting this domain or any associated links. If you have already interacted with this site, change any passwords used and monitor accounts for suspicious activity. For ongoing protection, verify all URLs on PhishDestroy before entering sensitive information. The combination of a recent creation date, high VT detection, and lack of SSL makes this a clear threat that should be avoided entirely.