play[.]beowux[.]com

Analysis conducted on July 19, 2026, identifies play.beowux.com as an active phishing domain targeting user credentials. The domain resolves to 64.7.198.11, an IP address geolocated in Romania and associated with BL Networks. Infrastructure is routed through Cloudflare nameservers (alla.ns.cloudflare.com and remy.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The domain is registered via Fewmoretaps OU, operating under the Trustname.com registrar brand, and secured with a Let's Encrypt SSL certificate (identifier YE1), which provides HTTPS encryption to lend legitimacy to the phishing page. VirusTotal telemetry indicates that 12 of 91 security vendors have flagged the domain as malicious, while it appears on at least one public blocklist. PhishDestroy has already classified the domain as a phishing threat and implemented blocking measures. The HTTP response status is 200, confirming the page remains accessible as of the report date. No specific brand impersonation or phishing kit has been confirmed in available data; however, the domain's structure and hosting pattern align with credential-harvesting campaigns. Defenders are advised to treat this domain as high-risk. Immediate actions include blocking the domain and its resolving IP at network and endpoint layers, monitoring for connections to 64.7.198.11, and alerting users who may have interacted with the site. Further analysis of the page content is required to determine the exact lure or brand impersonation, if any. Given the use of Cloudflare and a short-lived SSL certificate, the infrastructure may be ephemeral, so rapid response is recommended.