stellar[.]beefy-hub[.]sbs

Analysis of the domain stellar.beefy-hub.sbs indicates a confirmed brand impersonation campaign targeting Google, with elevated risk due to infrastructure and detection patterns. The domain was registered on October 25, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals it resolves to IP 142.250.186.100, which is hosted on Google LLC’s autonomous system (AS15169) in Germany. This IP association is unusual for a phishing domain, as it aligns with legitimate Google infrastructure, though it does not confirm direct involvement. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting origins and leverage Cloudflare’s privacy features.

Detection data shows the domain is flagged by 9 of 95 security vendors on VirusTotal, a clear indicator of malicious intent. It appears on at least one security blocklist and is blocked by PhishDestroy. The page title, 'Google,' aligns with the reported brand impersonation, though no further content analysis is available to confirm specific phishing mechanics or payloads. The domain lacks an SSL certificate, which is atypical for legitimate sites but not uncommon in low-effort phishing campaigns. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification.

Defenders should treat this domain as a confirmed threat, particularly for Google-branded phishing. The combination of Cloudflare nameservers, Google-hosted IP, and detection by multiple vendors suggests a deliberate attempt to exploit trust in Google’s infrastructure. While the domain is currently offline, monitoring for reactivation or associated indicators (IP, nameservers, registrar patterns) is recommended. No evidence links this domain to a specific phishing kit or broader campaign, so correlation with other Google impersonation domains may provide additional context. Review logs for connections to 142.250.186.100 or DNS queries for stellar.beefy-hub.