hemi[.]beefy[.]bar

The domain hemi.beefy.bar is registered through Dynadot LLC and was created on October 01, 2025. DNS resolution points to IP address 142.250.186.36, an address owned by Google LLC (AS15169) and geolocated in the United States. The domain employs Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed for the site, indicating that HTTPS was not configured.

An HTTP request returned a page title of "Google," matching the declared brand target. The domain is classified as a brand impersonation campaign targeting Google, and it has been identified as a phishing vector. Detection evidence includes a listing on one security blocklist, specifically PhishDestroy, and two of ninety‑five VirusTotal scanners flagging the domain. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is currently offline, limiting direct content analysis, and no additional payload or kit information is available. Defenders should treat hemi.beefy.bar as malicious, block resolution at DNS and proxy layers, and add the domain to local blocklists. Continuous monitoring is advised to detect any re‑registration or changes in resolution that could resurrect the threat. Given the corroborating indicators—registrar data, IP ownership, blocklist presence, low trust score, and brand impersonation—there is a high confidence that the domain was used for credential‑stealing or related malicious activity targeting Google users.