graph[.]app-beefy[.]sbs

This domain, graph.app-beefy.sbs, is flagged as a high-risk generic phishing site targeting users of the Beefy Finance decentralized finance platform. Analysis indicates the domain hosts a deceptive nginx landing page, a common tactic to mimic legitimate service interfaces while harvesting credentials or deploying malicious payloads. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with known phishing campaigns impersonating cryptocurrency and DeFi services. Infrastructure analysis reveals the domain was registered on May 31, 2024, through Dynadot LLC, a registrar frequently exploited for malicious registrations. It resolves to IP address 172.67.200.208, a Cloudflare-associated address often used to obfuscate hosting origins. VirusTotal detection metrics show 3 out of 95 security vendors flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may lend false credibility to the site. Google Safe Browsing status remains unconfirmed at this time. The domain remains active as of the latest verification, with no takedown actions observed. Response measures should include immediate blocklisting at the network and endpoint levels, as well as user education to recognize DeFi-related phishing tactics. Despite low detection counts, the domain poses a significant risk due to its targeted impersonation of a high-value financial service. Organizations are advised to monitor for related infrastructure, including subdomains or IP reuse, and to verify SSL certificate chains for anomalies in similar campaigns.