metis[.]beefyapp[.]lol

On 23 July 2026 analysts observed the domain metis.beefyapp.lol associated with a brand‑impersonation campaign targeting Google. The domain was registered on 5 October 2025 through Dynadot LLC and resolves to the IP address 142.250.181.228, which belongs to AS15169, Google LLC, United States. Despite the IP belonging to Google’s infrastructure, the domain does not present an SSL certificate, indicating a lack of TLS protection for any traffic it may serve. VirusTotal reports that 13 of 95 security vendors have flagged the domain, providing moderate detection confidence. The page title returned by the HTTP response is the literal string "Google", matching the declared brand target and confirming the impersonation intent.

The domain’s authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both managed by Cloudflare. It has been listed on a single security blocklist and is currently blocked by the PhishDestroy service. The domain’s current status is offline, suggesting that the hosting content has been taken down or the site is otherwise inaccessible. Uncertainty remains around the actual content served while the domain was active, as no SSL certificate or detailed page snapshot is available.

The lack of additional blocklist listings or broader community reports limits the ability to assess the scale of the campaign. Defenders should monitor DNS queries for metis.beefyapp.lol and its associated IP address, enforce blocklisting of the domain in inbound and outbound filters, and consider adding the IP 142.250.181.228 to network threat‑intel feeds, recognizing that the IP is part of Google’s public range and may host legitimate services. Continuous re‑evaluation of VirusTotal and other vendor detections is recommended to capture any changes in classification. Organizations should also verify that user‑education materials reference this specific impersonation attempt to reduce the risk of credential harvesting targeting Google accounts.