beefy[.]beefy-hub[.]lol

Analysis indicates that the domain beefy.beefy-hub.lol was registered on 25 October 2025 through Dynadot LLC. The domain resolves to the IP address 142.251.167.106, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Google Safe Browsing classifies the site as a social engineering threat, and fifteen of ninety‑five VirusTotal scanners have raised detections, confirming malicious intent.

Trust metrics are extremely low, with Gridinsoft assigning a score of 0 out of 100 and Scamadviser a score of 1 out of 100. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. The page title returned by the HTTP response is “Google”, while the threat profile identifies the campaign as a brand‑impersonation targeting Facebook. The overall risk rating is high, and the site is currently taken offline.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as the content of the landing page has not been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any related sub‑domains that may share the same registrar or hosting infrastructure. Additional scrutiny of traffic to the associated IP range is advisable, given its association with a major cloud provider. Organizations should also educate users about unsolicited requests that appear to originate from Facebook, reinforcing the importance of verifying URLs before entering credentials.