docs[.]beefyguard[.]com

Analysis indicates that docs.beefyguard.com is an active brand-impersonation site targeting Telegram users. The domain was registered through NameCheap, Inc. on 10 November 2025 and is hosted on a Vercel infrastructure that presents an HSTS header. DNS resolution points to IP 64.29.17.1, which belongs to Amazon.com, Inc. (AS16509) located in the United States. The authoritative nameservers are delilah.ns.cloudflare.com and lakas.ns.cloudflare.com, indicating Cloudflare DNS services. The site serves an HTTPS certificate issued by Let’s Encrypt (R12) and returns HTTP 200 for the root request, confirming functional web content. The page title observed is “BeefyGuard Dashboard”, though no further content analysis is available. Threat intelligence flags the domain as a brand-impersonation campaign aimed at Telegram.

Twenty-three security vendors on VirusTotal have evaluated the host; thirteen of the ninety-five scanners currently flag it as malicious. It appears on a single external blocklist and is explicitly blocked by the PhishDestroy service. The Gridinsoft trust score of 0 / 100 further reinforces its malicious classification. The presence of HSTS suggests the operator is attempting to enforce secure connections, a common tactic to increase credibility. Uncertainties remain regarding the specific payload or credential-harvesting mechanisms employed, as the page content beyond the title has not been captured. No public Safe Browsing or OTX entries are referenced, and no additional blocklist detections are reported beyond the one listed.

Consequently, the full scope of victim interaction and data exfiltration cannot be precisely measured at this time. Defenders should immediately add docs.beefyguard.com to deny-list rules across perimeter firewalls, web proxies, and DNS filtering solutions. Endpoint protection platforms should be configured to block connections to the resolved IP address 64.29.17.