momentum[.]beefy[.]bar

Analysis indicates that the domain momentum.beefy.bar was registered on 2025-10-01 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The site is currently offline and has been taken down by the PhishDestroy takedown service. No TLS certificate is presented, and HTTP requests would be served without encryption. DNS resolution points to the IP address 142.250.185.228, which belongs to AS15169 Google LLC and is located in the United States.

The page title returned by the server is exactly "Google", matching the declared brand target, and the domain is listed as a brand‑impersonation of Google. VirusTotal scans show that nine out of ninety‑five security vendors flagged the domain, and it appears on at least one public blocklist. The limited detection footprint and the lack of an active SSL certificate suggest a short‑lived infrastructure typical of opportunistic impersonation campaigns.

Uncertainty remains regarding the specific phishing kit or payload used, as no content analysis is available. Defenders should continue to block the domain at perimeter filters, monitor the associated IP for any future abuse, and add the domain to internal blacklists. Additional telemetry such as HTTP response codes, content hashes, and user‑reporting should be collected if the site resurfaces, to refine detection signatures.