crv[.]beefyhub[.]club

The domain crv.beefyhub.club was observed hosting a brand‑impersonation page that presents the page title “Google”. The domain was registered through Dynadot LLC on 21 October 2025 and uses the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.185.164, an address that belongs to AS15169 Google LLC and is geolocated in the United States. No SSL/TLS certificate was presented during connection attempts, indicating that the site either served only HTTP or relied on an invalid certificate, a pattern often used to evade certificate‑based reputation checks.

The site was flagged by five of ninety‑five VirusTotal scanners, received a Gridinsoft trust score of 0 / 100, and appears on a single external blocklist. PhishDestroy has actively taken the domain offline, and the current status is recorded as “offline”. The page title alone suggests an attempt to masquerade as Google, matching the declared brand target, but the underlying content has not been captured, leaving the exact phishing vector (login form, credential‑stealing page, etc.) uncertain. The use of a legitimate Google IP address may be an attempt to blend with benign traffic, complicating network‑level detection.

Defenders should immediately block the domain and its associated IP at perimeter firewalls and DNS filtering solutions. Continuous monitoring of the Cloudflare name servers for any re‑registration or rapid DNS changes is recommended. Because the site is already offline, threat‑intel platforms should be updated to reflect the takedown, and any residual hashes or payloads reported by the five VirusTotal vendors should be ingested into endpoint detection rules. Organizations that enforce brand‑specific Safe Browsing lists should add crv.beefyhub.club to their watchlist to prevent future re‑use of the same indicator.