flow[.]beefyhubs[.]lol

The domain flow.beefyhubs.lol was registered on October 21, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to the IP address 142.251.40.164, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The domain is served by Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that any HTTP service would be delivered over an unsecured connection. The page title returned from the site is "Google," while the listed scam type is brand impersonation targeting Facebook.

Trust‑rating services reflect extreme distrust: Scamadviser assigns a score of 1 / 100 and Gridinsoft reports a score of 0 / 100. VirusTotal analysis shows that 10 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on a single external blocklist. PhishDestroy has already blocked the domain, and it is listed as a known brand‑impersonation site.

Evidence suggests the operator leveraged a legitimate Google‑owned IP address, likely to benefit from the reputation of the host network. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any re‑registration attempts, and incorporate the indicator set (domain, IP, name servers, registrar) into threat‑intel feeds. Because the site is offline, active harvesting cannot be confirmed, but the combination of low trust scores, lack of encryption, and multiple vendor detections substantiates a high confidence rating for malicious intent aimed at Facebook credential theft.