chainlink[.]beefyapp[.]cfd

The domain chainlink.beefyapp.cfd is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as the legitimate Google login page to deceive users into entering sensitive credentials. No crypto drainer kit was identified. The site is currently taken offline, but it previously posed an elevated risk due to its deceptive nature.

Technical indicators confirm the domain's malicious intent. As of analysis, 2 of 95 VirusTotal security vendors flagged chainlink.beefyapp.cfd, while it appeared on 1 security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 02, 2025, and resolved to the IPv6 address 2607:f8b0:4004:c25::69, hosted under Google LLC's AS15169. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who interacted with chainlink.beefyapp.cfd should immediately change their Google passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google's Safe Browsing team and consider submitting it to additional threat-sharing platforms like PhishTank or OpenPhish for broader awareness.