ewt[.]beefyapp[.]sbs

The domain ewt.beefyapp.sbs is a confirmed phishing site engaged in brand impersonation targeting Google. It presents itself as the legitimate Google login page to deceive users into entering credentials, posing an elevated risk of account compromise. No crypto drainer kit was identified. The site is currently taken offline, but prior activity remains a threat to users who may have interacted with it.

Technical indicators show ewt.beefyapp.sbs was flagged by 3 of 95 VirusTotal security vendors, including ChainPatrol, SOCRadar, and Webroot. It appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. The domain was registered through Dynadot LLC on 2025-10-02 13:24:41 and resolves to IP address 142.250.185.228, hosted on Google LLC infrastructure in the US (AS15169). No SSL certificate is present, and the observed page title is 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigns a trust score of 0/100.

Users who visited ewt.beefyapp.sbs should immediately change their Google account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google via their phishing reporting tool and to the registrar, Dynadot LLC, for further investigation. If financial or personal data was entered, consider contacting relevant institutions to secure accounts.