magma[.]beefy-hub[.]sbs

On July 24, 2026 analysts examined the domain magma.beefy-hub.sbs, which was observed impersonating Google. The domain was registered through Dynadot LLC on October 25, 2025 and is currently taken offline. DNS resolution points to IP address 142.251.40.164, an address owned by Google LLC (AS15169) located in the United States.

The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet no SSL certificate was presented during the brief scan, indicating the site was not delivering HTTPS content. Page title retrieval returned the literal string "Google," matching the declared brand target and confirming the impersonation intent. Threat intelligence feeds flagged the domain on a single security blocklist, specifically PhishDestroy, and Google Safe Browsing classified the URL as a social engineering threat.

VirusTotal analysis recorded eight detections out of ninety‑five scanned security vendors, reinforcing the suspicion of malicious use. The elevated risk rating reflects the combination of brand impersonation, presence on a phishing blocklist, and multi‑vendor detections. Defenders should continue to monitor the domain for any re‑activation, ensure that network perimeter controls block traffic to the associated IP, and incorporate the observed indicators—registrar, nameservers, IP address, and detection signatures—into threat‑intel feeds to pre‑empt potential phishing campaigns targeting Google users.