usual[.]beefyhubs[.]click

The domain usual.beefyhubs.click was registered on 22 October 2025 through Dynadot LLC and is presently taken offline. DNS resolution points to IP address 142.250.186.164, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating Cloudflare DNS services. No TLS certificate is presented, so the site would be served over plain HTTP if accessed.

The page title returned by the server is "Google", and the threat classification in intelligence sources identifies the campaign as a brand‑impersonation attempt targeting Google. VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, and the domain appears on a single external blocklist, currently blocked by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent.

Because the site is offline, direct content inspection is not possible, leaving the exact phishing page layout and credential‑collection mechanisms unknown. Defensive operators should continue to block the domain at perimeter and DNS layers, monitor the associated IP and nameserver infrastructure for any future re‑use, and update any URL filtering lists with the domain identifier. Continuous observation of the IP 142.250.186.164 for unexpected traffic patterns is advised, as the address is owned by Google and could be leveraged for other malicious campaigns.