wlfi[.]beefyapp[.]lol

This domain wlfi.beefyapp.lol has been identified as a brand‑impersonation site targeting Google. The domain was registered on 5 Oct 2025 through Dynadot LLC and is configured to use Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP 142.250.185.132, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate was presented when the host was queried, indicating that the site operated without HTTPS. The HTTP response returned a page whose title element is exactly “Google”, matching the declared brand target.

Endpoint analysis shows that four of ninety‑five VirusTotal scanners flagged the domain as malicious, confirming the presence of suspicious activity. The domain is listed on one external blocklist and has been actively blocked by the PhishDestroy service, which suggests that at least one commercial feed has recognized it as a threat. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) reports were observed in the available intelligence. The site’s current status is offline, limiting immediate interaction but not eliminating residual risk. Threat actors may have used the domain to harvest credentials or deliver additional payloads before takedown.

Because the underlying IP is owned by Google’s infrastructure, any future reuse of the same address could obscure attribution. Defenders should continue to monitor the IP address and associated CIDR ranges for re‑appearance of malicious content, and enforce strict URL filtering for any request to wlfi.beefyapp.lol or its subdomains. Organizations using Google services should educate users about unexpected login prompts and ensure that corporate browsers enforce HTTPS‑only mode, which would have prevented a non‑TLS connection.