klima[.]beefyhubs[.]life

This domain, klima.beefyhubs.life, was observed as an offline site that resolves to the IP address 172.217.18.4, which belongs to AS15169 Google LLC in the United States. The domain is registered through Cloudflare, Inc., but its authoritative nameservers could not be retrieved (NS_NOT_FOUND). VirusTotal reports that 13 of 95 scanned security vendors flag the domain, indicating a moderate level of detection across multiple engines. Google Safe Browsing classifies the URL as a social engineering threat, and the page title returned by the HTTP response is the literal string “Google”, matching the declared brand target of Google.

The site appears on a single external blocklist and is specifically listed by PhishDestroy as a malicious entry. No TLS certificate was presented during the connection attempt, confirming the absence of HTTPS protection. The combination of brand impersonation, social‑engineering labeling, and multiple vendor detections suggests that the domain was used to lure victims into a credential‑harvesting flow, although the exact payload or landing page content has not been captured.

Uncertainty remains regarding the current hosting configuration because the domain is offline and the DNS infrastructure cannot be resolved, limiting further technical analysis of server‑side artifacts. Defenders should immediately add klima.beefyhubs.life to URL filtering and DNS block lists, monitor for any re‑registration or DNS changes, and correlate internal logs for any prior connections to the resolved IP. Continuous observation of Cloudflare‑registered domains targeting Google and the reuse of Google’s IP space is advised to prevent future impersonation campaigns.