threshold[.]beefyapp[.]bond

The domain threshold.beefyapp.bond is a confirmed phishing site engaged in brand impersonation targeting Google. It presents itself as a legitimate Google login page to deceive users into entering credentials, constituting a credential-stealing scam. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk but not eliminating the potential for future misuse.

Technical indicators confirm threshold.beefyapp.bond as malicious. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on 2025-10-02 13:24:41 and resolves to IP address 172.217.18.4, hosted on Google LLC infrastructure (AS15169). It appears on 1 security blocklist (PhishDestroy) and lacks an SSL certificate. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The observed page title was 'Google', reinforcing its impersonation of the legitimate brand.

Users who interacted with threshold.beefyapp.bond should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the domain to Google’s phishing reporting tool and to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader takedown efforts.