nexusmutual[.]beefyapps[.]cfd

This domain, nexusmutual.beefyapps.cfd, was observed as a brand‑impersonation site targeting Google. The page title returned the string “Google”, matching the declared brand target. Registration details show the domain was created on 24 October 2025 through Dynadot LLC. DNS resolution points to 142.251.40.164, an address owned by AS15169 Google LLC located in the United States. The domain employed Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet no TLS certificate was presented, leaving the site accessible only over plain HTTP.

Threat intelligence indicates that six of ninety‑five VirusTotal scanners flagged the host as malicious, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the suspicion of malicious intent. The domain appears on a single security blocklist and has been listed by PhishDestroy as blocked. As of the reporting date, the site is taken offline, and no active HTTP response was recorded.

Current gaps include the absence of a detailed payload analysis, lack of known phishing kit identifiers, and no public repository of captured traffic. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for reuse, and watch for similarly structured subdomains under the same registrar or Cloudflare nameserver pair. Ongoing correlation with additional threat feeds is advised to detect any resurrection or related campaigns.