sym[.]beefyapp[.]cfd

Analysis of sym.beefyapp.cfd as of July 23, 2026 shows that the domain was registered on October 2, 2025 through Dynadot LLC. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating Cloudflare DNS services. No TLS certificate is presented, and the HTTP response lacks HTTPS, which is atypical for a site claiming to represent Google. The site resolves to IP address 142.250.185.68, which belongs to AS15169 Google LLC located in the United States. This IP is owned by Google’s own infrastructure, suggesting the domain is leveraging a legitimate Google‑owned address to increase credibility.

The page title returned by the server is simply “Google”, matching the declared brand target. VirusTotal scans have recorded six detections out of ninety‑five participating security vendors, and the domain appears on one public blocklist. The Gridinsoft trust score is 0 out of 100, and the domain has been taken offline and flagged by the PhishDestroy mitigation service. The combination of brand impersonation, use of a Google‑owned IP, lack of TLS, and multiple vendor detections points to a high‑confidence malicious impersonation campaign.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no content analysis or HTTP status codes have been published. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the domain or its subdomains, and add the IP address to reputation‑based filtering rules. Further investigation of any traffic that reached the domain while it was active, and sharing of any additional indicators with threat‑intel platforms, is recommended.