dot[.]beefyapp[.]lol

This domain, dot.beefyapp.lol, is flagged as a brand impersonation threat targeting Google. Analysis indicates the infrastructure was designed to mimic Google’s login interface, as evidenced by the page title “Google” and confirmed credential theft intent. No crypto drainer or payment skimming components were detected in available telemetry, distinguishing this as a focused credential harvesting operation. Infrastructure analysis reveals the domain was registered through Dynadot LLC on October 05, 2025, and resolved to the IP address 142.251.40.196. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed prior to takedown. No association with Google Safe Browsing (GSB) listings was recorded at the time of analysis. The domain is currently offline, having been taken down following detection. While the immediate threat is mitigated, residual risk remains due to potential credential exposure from prior interactions. Users who accessed the site before deactivation should assume credentials were compromised and initiate password resets on legitimate Google services. Organizations are advised to monitor for unauthorized access attempts linked to this campaign, particularly targeting corporate or high-value accounts.