tia[.]beefyhubs[.]club

On 25 July 2026, analysts examined the domain tia.beefyhubs.club, which was observed hosting a brand‑impersonation campaign targeting Google. The domain was registered on 22 October 2025 through Dynadot LLC. DNS resolution points to 142.250.74.196, an address owned by AS15169 Google LLC and located in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare. No TLS certificate was presented during connection attempts, resulting in an unencrypted HTTP service. The page title returned by the server is “Google”, matching the declared impersonated brand.

Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal analysis shows that two of ninety‑five antivirus engines flagged the domain, confirming at least partial detection by security products. The site’s current status is offline, limiting immediate observation, and no further content was captured.

Evidence gaps include the absence of a SSL certificate, lack of detailed payload or phishing page screenshots, and limited detection coverage beyond the two positive VirusTotal hits. Defenders should continue to monitor the IP address for any re‑use, enforce DNS‑level blocks for the domain and its associated IP, and consider adding the domain to internal blocklists. Additional investigation of traffic logs for connections to the Cloudflare name servers may reveal related infrastructure. Ongoing vigilance is recommended, especially given the use of a legitimate Google‑owned IP range, which can aid evasion.