mmt[.]beefyapp[.]cfd

The domain mmt.beefyapp.cfd was registered on 02 Oct 2025 through Dynadot LLC and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 142.250.188.4, which belongs to AS15169 Google LLC and is located in the United States. The use of Google’s own IP range, combined with a page title of “Google”, indicates a deliberate attempt to masquerade as a legitimate Google service. The domain is served without an SSL certificate, and its authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare. VirusTotal reports that nine of ninety‑five scanning engines have flagged the domain, providing independent confirmation of malicious intent.

The site has been added to the PhishDestroy blocklist and appears on one additional security blocklist, demonstrating that external threat‑intelligence feeds are already observing the indicator. The brand target is explicitly identified as Google, confirming a brand‑impersonation motive. Evidence gaps remain regarding the specific payload or credential‑harvesting mechanisms employed, as the site content has not been captured and no HTTP response details are available. Likewise, Safe Browsing status, OTX references, and detailed trust‑score metrics are not provided in the current intelligence set.

Defenders should prioritize blocking the domain at network and DNS layers, incorporate the host IP and nameserver entries into existing firewall and proxy rules, and monitor for any future resolution to the same IP range. Given the alignment with Google’s IP space, any legitimate traffic to Google services should be distinguished by additional context such as TLS fingerprinting or known Google endpoints. Continuous ingestion of updates from PhishDestroy, VirusTotal, and the observed blocklist will help maintain situational awareness.