soph[.]beefy[.]bar

Analysis of soph.beefy.bar indicates a confirmed brand impersonation campaign targeting Google, currently offline as of July 24, 2026. The domain was registered on October 1, 2025, through Dynadot LLC and uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com), a common infrastructure choice for threat actors to obscure hosting origins. It resolved to IP 142.250.186.36, which is assigned to Google LLC (AS15169), suggesting either IP spoofing or temporary use of Google-hosted resources before takedown.

No SSL certificate was detected, increasing the likelihood of interception or man-in-the-middle risks during active operation. The domain appears on one security blocklist (PhishDestroy) and is flagged by 7 of 95 security vendors in VirusTotal, confirming malicious classification. The page title 'Google' aligns with the reported scam type (brand impersonation), though the exact content or phishing kit remains unanalyzed.

Defenders should treat this domain as high-risk for credential harvesting or malware distribution, particularly given its historical association with Google-themed lures. While currently offline, monitoring for re-registration or DNS changes is recommended. Infrastructure analysis reveals no legitimate use case, and the domain should be blocked at the network and endpoint levels pending further review.