sca[.]beefy-hub[.]lat

Analysis indicates that the domain sca.beefy-hub.lat was registered on 25 October 2025 through Dynadot LLC and is currently taken offline. The domain resolves to IP 142.250.188.4, an address owned by Google LLC (ASN 15169) located in the United States. DNS resolution is handled by the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed, meaning the site did not serve HTTPS.

The page title returned by HTTP requests is "Google," which does not correspond to the advertised brand target of Facebook, confirming a mismatch often associated with brand‑impersonation campaigns. The Gridinsoft trust score for the domain is 0 out of 100, indicating a lack of trust. Detection services have flagged the domain: twelve of ninety‑five VirusTotal scanners reported malicious behavior, and PhishDestroy has listed it as blocked. It appears on one additional security blocklist.

The absence of a certificate and the offline status limit the ability to observe any login pages or payloads, so the specific malware or credential‑harvesting techniques remain unknown. Defenders should continue to enforce DNS‑level blocking of the domain, monitor for any resurrection of the host or related sub‑domains, and consider adding the IP address 142.250.188.4 to their outbound filtering rules, despite its association with a reputable provider, because abuse can be transient. Ongoing watch‑listing in threat‑intel feeds, especially those that incorporate the observed vendor detections, is recommended to catch future activity that may reuse the same registration profile or hosting infrastructure.