mon[.]beefy-hub[.]lol

Analysis of the domain mon.beefy-hub.lol, observed on July 23, 2026, indicates a short‑lived brand‑impersonation campaign targeting Google. The domain was registered on 25 October 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to the IP address 142.250.186.164, which belongs to AS15169 Google LLC and is geolocated in the United States. The name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are Cloudflare‑managed, suggesting the infrastructure relied on Cloudflare’s DNS service.

No TLS certificate was detected for the host, implying that any HTTP service would have been delivered without encryption. The page title returned “Google”, matching the declared brand target, but the actual page content has not been captured because the site is no longer reachable. VirusTotal records show that 14 of 95 scanning engines flagged the domain, indicating a moderate level of confidence among security vendors that the site was malicious. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy platform, confirming that at least one anti‑phishing service has taken remediation action.

Because the site is offline, active probing cannot confirm the presence of credential‑stealing forms or additional payloads. Uncertainties remain regarding the exact phishing kit or payload delivered, the timing of the campaign’s activity, and whether the IP address was used solely for this domain or is shared with legitimate Google services. Defenders should block the domain and its associated IP address at network perimeters, add the domain to internal URL filtering and threat‑intel feeds, and monitor for newly registered sub‑domains under the beefy‑hub.lol suffix that may reuse the same infrastructure. Continued observation of Cloudflare name server patterns and the registrar Dynadot may help identify future campaigns that employ a similar registration and hosting profile.