bob[.]beefyhubs[.]cfd

bob.beefyhubs.cfd was observed directing HTTP requests to the IP address 142.250.185.132. The IP resides in the United States and is announced by ASN 15169, which is owned by Google LLC. The domain is hosted on Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and was registered on October 21, 2025 through Dynadot LLC. No TLS certificate was presented during connection attempts, indicating that the site was served without HTTPS. The page title returned by the server is “Google”, matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign.

VirusTotal analysis recorded four positive detections out of ninety‑five scanning engines, and the domain appears on a single public blocklist that is actively enforced by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust rating of zero out of one hundred, reflecting a high confidence in malicious intent. The domain’s current status is offline, but the infrastructure artifacts—particularly the use of legitimate Google‑owned IP space and Cloudflare DNS—suggest an attempt to exploit trusted network resources to increase credibility.

Defenders should continue to block the domain and the associated IP address at perimeter controls, add the fully qualified domain name to internal blacklists, and monitor for any future re‑registration or similar patterns that reuse Google‑owned IP ranges combined with Cloudflare name servers. Ongoing telemetry collection is recommended to capture any residual activity that may persist in compromised client systems.