spaceandtime[.]beefy-hub[.]sbs

Analysis of the domain spaceandtime.beefy-hub.sbs, observed on July 24, 2026, indicates that it was used for a brand impersonation campaign targeting Google. The domain was registered through Dynadot LLC on October 25, 2025 and resolves to the IP address 142.250.184.196, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the IP belonging to Google’s infrastructure, the domain does not present an SSL certificate, leaving the connection unencrypted. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare DNS services. The site’s HTML title is “Google”, matching the declared brand target, and the campaign is classified as brand impersonation.

Automated scanning by VirusTotal resulted in nine of ninety‑five security vendors flagging the domain as malicious, reinforcing the suspicion of illicit activity. Additional detection includes placement on a single security blocklist and a block by the PhishDestroy service. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. No evidence of a valid SSL certificate, no indication of Safe Browsing or Open Threat Exchange entries, and the current operational status is offline. Uncertainty remains regarding the specific phishing kit or payload delivered, as the page content has not been captured.

The lack of SSL, the low trust score, and the multiple vendor detections suggest a high likelihood of malicious intent, but analysts cannot confirm the exact user‑facing behavior without live samples. Defenders should add the domain to blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce strict TLS validation to prevent connections to non‑encrypted hosts. Network sensors should flag traffic to the IP 142.250.184.196 when associated with the domain name, and endpoint security solutions should treat the nine VirusTotal detections as a strong indicator of compromise.