flow[.]beefyhubs[.]cfd

flow.beefyhubs.cfd is currently offline but historical data show it was registered on October 21 2025 through Dynadot LLC. The domain resolves to IP 142.250.185.196, an address owned by Google LLC (AS15169) located in the United States. The use of a Google‑owned IP suggests the attacker leveraged legitimate cloud infrastructure to host the malicious site, a common tactic for brand‑impersonation campaigns seeking to evade reputation checks. The domain employs Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that any HTTP‑only service would have been unencrypted. Gridinsoft’s trust scoring engine assigned a rating of 0 / 100, and the domain appears on a single security blocklist.

PhishDestroy has already taken the site offline, confirming that it was identified as a phishing vector. VirusTotal analysis shows three of ninety‑five scanning engines flag the domain, reinforcing the suspicion of malicious intent. The page title returned “Google,” matching the declared brand target and confirming the intent to impersonate Google. No additional content, kits, or payload details have been disclosed, so the exact phishing workflow remains unknown.

Defenders should continue to block the domain at perimeter filters, monitor for any future re‑registration attempts, and consider adding the domain to internal blacklists even though it currently resolves to a legitimate Google IP. Ongoing observation of the associated IP for anomalous traffic patterns is advisable, as compromised legitimate infrastructure can be abused intermittently. Because the domain is already offline, active takedown is not required, but awareness of the tactic—using reputable hosting and non‑SSL endpoints to mimic a well‑known brand—should inform broader threat‑intel and detection rule updates.