usual[.]beefyhubs[.]bond

usual.beefyhubs.bond is flagged as a Google brand impersonation campaign. The domain was registered on 26 October 2025 through Dynadot LLC and is hosted on IP address 142.250.80.100, which belongs to AS15169 Google LLC in the United States. DNS resolution points to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no SSL certificate was observed, indicating that the site was served over plain HTTP before being taken offline.

The page title returned by the HTTP response is “Google”, matching the declared brand target and confirming the intent to mimic the legitimate service. Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist, PhishDestroy, which has already listed it as malicious. VirusTotal analysis recorded six detections out of ninety‑five scanners, providing additional corroboration of malicious activity.

The current status is offline, which limits immediate threat exposure but suggests the operators have withdrawn the site, possibly to evade further takedown actions. Defenders should continue to block the domain and its associated IP address at perimeter and endpoint layers, update URL filtering rules to include the observed nameservers, and monitor for any re‑registration or reuse of the same infrastructure. Ongoing vigilance is recommended because the underlying IP belongs to a large cloud provider that may be leveraged for future campaigns.