zeebu[.]beefy[.]bar

zeebu.beefy.bar was registered on 1 October 2025 through Dynadot LLC. The domain resolves to the IP address 142.250.181.228, which is announced by AS15169 belonging to Google LLC and is geolocated in the United States. The site presented a page title of "Google" and was classified as a brand‑impersonation campaign targeting Google. No TLS certificate was observed, indicating the site operated over plain HTTP.

The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the infrastructure is hosted behind Cloudflare’s DNS service. Automated scanning by VirusTotal returned nine positive detections out of ninety‑five submitted engines, confirming the presence of malicious indicators. The domain was added to PhishDestroy’s blocklist and appears on a single external security blocklist, leading to its current offline status.

The lack of a live HTTP response prevents direct analysis of the payload, login form, or credential‑stealing mechanisms, so the exact content remains unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for future re‑use of the same nameservers or IP range, and consider adding the associated IP address to reputation filters despite its legitimate ownership. Ongoing observation of new registrations from Dynadot that reference Google‑related keywords is recommended to catch similar brand‑impersonation attempts early.