metis[.]beefyapp[.]sbs

Analysis indicates that the domain metis.beefyapp.sbs was registered through Dynadot LLC on 02 October 2025 and is currently offline. DNS resolution points to the IP address 142.250.181.228, an address owned by AS15169 Google LLC located in the United States. The use of a Google‑owned IP suggests an attempt to blend malicious traffic with legitimate Google infrastructure, a technique commonly observed in brand‑impersonation campaigns. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, providing CDN and DDoS mitigation services, but no TLS certificate was observed, indicating that any HTTP service would be delivered without encryption.

The page title returned upon request was simply “Google”, matching the declared target brand. The site has been flagged by at least five of ninety‑five VirusTotal scanners, and it appears on a single external security blocklist. PhishDestroy has already taken the domain offline, and the domain is listed as taken offline in the current intelligence feed.

The combination of a recent registration, use of a high‑reputation IP range, Cloudflare DNS, lack of HTTPS, and detection by multiple security vendors constitutes a moderate to elevated risk profile for brand‑impersonation. Defenders should ensure that the domain is added to local deny lists, monitor DNS queries for the associated Cloudflare nameservers, and verify that any outbound connections to the IP are blocked or inspected. Continuous re‑evaluation is recommended in case the domain is re‑activated or the underlying infrastructure is altered.