mmt[.]beefyhubs[.]cfd

Analysis of the domain mmt.beefyhubs.cfd indicates it was actively impersonating Google as part of a brand impersonation campaign. The domain was registered on October 21, 2025, through Dynadot LLC and resolved to the IP address 142.251.40.164, which is geolocated in the United States and associated with AS15169 (Google LLC). This IP resolution is notable, as it suggests the domain may have been hosted on infrastructure linked to the very brand it sought to impersonate, potentially to evade detection or lend an appearance of legitimacy. The domain's nameservers were hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting origins and complicate takedown efforts. At the time of assessment, the domain's page title was explicitly 'Google,' reinforcing its intent to deceive users into believing they were interacting with an official Google service.

No SSL certificate was detected, which is atypical for legitimate services and increases the likelihood of interception or manipulation of user data. The domain appeared on at least one security blocklist, specifically PhishDestroy, and was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate but not universal detection. The domain has since been taken offline, though the exact timing and method of its removal are not confirmed. Infrastructure analysis reveals that the domain's creation date, registrar, and hosting patterns align with known phishing campaigns targeting major technology brands.

The use of Cloudflare nameservers and the absence of SSL further support this classification. Defenders are advised to monitor for residual DNS records or subdomains associated with mmt.beefyhubs.cfd, as these may resurface in future campaigns. Network-level blocking of the IP 142.251.40.164 for non-Google traffic is recommended, along with continued vigilance for similar domains registered through Dynadot or utilizing Cloudflare nameservers.