sophon[.]beefy[.]bar

Analysis of sophon.beefy.bar shows a brand‑impersonation infrastructure targeting Google. The domain was registered through Dynadot LLC on 1 October 2025 and resolves to the IP address 216.58.206.36, which belongs to ASN 15169 (Google LLC) and is geolocated in Germany. The use of Google‑owned IP space is a common tactic to lend credibility to malicious pages. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s DNS service to hide the true origin of the server. No TLS certificate is presented, so HTTPS connections would be rejected or fall back to HTTP, which further reduces user trust.

The page title returned by the HTTP response is simply “Google”, matching the declared brand target. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records seven detections out of ninety‑five scanners, confirming that multiple security products flag the host as malicious. The domain appears on one public blocklist and is listed as blocked by PhishDestroy, demonstrating that at least one anti‑phishing service has taken action. The current operational status is offline, which may indicate that the phishing campaign has been taken down or is temporarily paused. Uncertainties remain regarding the exact content that was hosted before takedown, the presence of any credential‑harvesting forms, and whether additional sub‑domains were used in parallel.

Defenders should continue to monitor the IP address 216.58.206.36 for any resurgence of malicious activity, add the domain and its resolved IP to internal blocklists, and enforce strict TLS inspection rules to prevent users from connecting over insecure HTTP. Network sensors should flag any DNS queries for sophon.beefy.bar, and endpoint protection solutions should treat the domain as malicious based on the existing VirusTotal detections and the zero‑score trust rating.