dot[.]beefyhubs[.]sbs

Analysis of dot.beefyhubs.sbs indicates a Google brand impersonation campaign. The domain, registered on 2025-10-21 through Dynadot LLC, resolves to 172.253.62.106, an IP owned by AS15169 Google LLC located in the United States. Despite the legitimate-looking IP, the domain lacks an SSL certificate and serves a page whose title is simply "Google", suggesting a minimal landing page used for brand spoofing. VirusTotal records show 15 of 95 security vendors have flagged the host, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification.

The nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com point to Cloudflare’s DNS infrastructure, a common choice for fast-flux or disposable phishing sites. The domain appears on one security blocklist and has been added to the PhishDestroy blocklist, confirming that defensive feeds are already aware of its activity. Current DNS resolution reports the domain as offline, indicating the operator may have taken the site down after initial distribution. However, the underlying IP remains under Google’s control, so the host could be repurposed for future campaigns.

Defenders should immediately add dot.beefyhubs.sbs to block lists, monitor outbound DNS queries for the associated IP and Cloudflare nameservers, and watch for newly created domains that share the same registrar or naming pattern. Because the page content has not been publicly archived, analysts should continue to request snapshots from web-capture services. Ongoing vigilance for similar brand-impersonation domains targeting Google is advised, especially those that resolve to high-reputation IP ranges but lack TLS protection.