metis[.]beefyhubs[.]sbs

Analysis of the domain metis.beefyhubs.sbs shows a newly registered site (creation date 21 Oct 2025) that was used to impersonate Google. The domain resolves to the IP address 142.250.184.228, which belongs to AS15169 owned by Google LLC and is located in the United States. Registration was performed through Dynadot LLC, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL/TLS certificate is presented, indicating that connections are unencrypted. The only visible page title is “Google”, matching the declared brand target.

VirusTotal has recorded 13 detections out of 95 scanning engines, and the domain appears on a single security blocklist. It has also been flagged by the PhishDestroy blocklist. The site is currently taken offline, and no HTTP status code or content snapshot is available for further verification. The evidence confirms that the infrastructure was deliberately crafted to resemble a Google login or service page, leveraging Google‑owned IP space to increase credibility.

However, the lack of a TLS certificate and the offline status limit the ability to assess the exact payload or credential‑ harvesting mechanisms that may have been deployed. Defenders should treat the domain as malicious, ensure that DNS resolvers block queries to metis.beefyhubs.sbs, and add the IP address 142.250.184.228 to network‑level deny lists only after confirming that legitimate Google services are not impacted. Continuous monitoring of newly created subdomains under the same registrar and nameserver pair is advised, as the same actors frequently generate additional impersonation sites. Organizations should also review endpoint protection alerts for the 13 VirusTotal detections associated with this domain and consider updating URL filtering rules to include the identified blocklist entries.