beefy[.]airdrpsalerts[.]cfd

Analysis indicates that the domain beefy.airdrpsalerts.cfd was registered through Dynadot LLC on 29 October 2025 and is currently taken offline. The domain resolves to the IP address 142.250.185.196, which belongs to the AS15169 Google LLC network and is located in the United States. Despite the IP belonging to Google’s infrastructure, the domain is being used for a brand‑impersonation campaign targeting Google, as evidenced by the page title “Google” and the explicit classification of the scam type as “Brand Impersonation”. The site presents no SSL certificate, which is atypical for a domain hosted on a legitimate ISP network and further reduces trust.

Reputation services reflect a very low credibility: Gridinsoft assigns a trust score of 0 / 100, while Scamadviser reports a score of 1 / 100. VirusTotal has recorded ten detections out of ninety‑five scanned engines, confirming that multiple security vendors flag the domain as malicious. The domain appears on one public blocklist and is specifically listed by PhishDestroy, indicating that at least one anti‑phishing service has taken action against it. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, showing that Cloudflare is the DNS provider.

Because the site is offline, active content cannot be examined, and the exact phishing payload or credential‑capture mechanism remains unknown. Defenders should add the domain and its resolved IP address to outbound blocklists, enforce DNS‑level filtering for the host, and monitor for any new sub‑domains that resolve to the same IP range. Given the use of a legitimate Google‑owned IP block, additional vigilance is recommended for traffic that appears to originate from Google infrastructure but targets the suspicious domain. Continuous observation of Dynadot‑registered domains that resolve to AS15169 may help identify future impersonation attempts.