mon[.]beefy[.]bar

The domain mon.beefy.bar was registered on October 01, 2025 through Dynadot LLC and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 216.58.212.132, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no SSL certificate was observed during the scan, indicating the site was delivered over plain HTTP. The page title returned by the web server is "Google", matching the declared brand target of Google and confirming the impersonation intent.

VirusTotal recorded seven detections out of ninety‑five security vendors, suggesting that a minority of scanners flagged the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. No additional threat‑intel sources such as OTX or Safe Browsing are referenced in the available data.

The evidence set does not include any content‑level analysis beyond the page title, leaving the exact phishing payload or credential‑capture mechanism uncertain. Defenders should add mon.beefy.bar to URL filtering and DNS block policies, monitor the associated IP range for any future activity, and consider the elevated risk rating when evaluating alerts that reference Google‑related brand impersonation. Continuous re‑scanning is advised to capture any changes in detection scores or the emergence of SSL certificates, which could affect the threat profile.