akt[.]beefy-hub[.]lol

This domain, akt.beefy-hub.lol, was registered through Dynadot LLC and first observed on October 25, 2025. The site resolves to the IP address 142.250.186.68, which belongs to AS15169 Google LLC and is geolocated in Germany. Authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate was presented during the scan, leaving the connection unencrypted. The page title returned by the HTTP response is “Google”, and Google Safe Browsing classifies the URL as a social‑engineering threat, confirming the intent to impersonate the Google brand.

VirusTotal recorded 13 detections out of 95 scanned security vendors, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as offline. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The lack of an SSL certificate means that any data submitted by a victim would be transmitted in clear text, a typical characteristic of low‑cost impersonation campaigns. The singular blocklist entry suggests limited exposure, yet the 13 VirusTotal detections indicate that multiple security products have identified malicious behavior associated with the domain.

Because the IP address is owned by Google, any future use of the same address could be legitimate, so correlation with traffic patterns is advisable. The current offline status prevents immediate exploitation, but the historical evidence warrants continued vigilance. Security teams should continue to block the domain and its associated IP address, add it to internal phishing and malware blocklists, update web filtering rules, enforce TLS inspection where possible, and educate users about unexpected Google‑related URLs that lack proper HTTPS protection.