flow[.]beefyhubs[.]life

The domain flow.beefyhubs.life was identified as a high‑risk brand‑impersonation campaign targeting Facebook users. Infrastructure analysis shows the domain resolves to 172.253.62.103, an address allocated to Google LLC (AS15169) in the United States. Registration was performed through Cloudflare, Inc., and no SSL certificate was presented at the time of observation, indicating the site was served over plain HTTP. The HTTP response included a page title of "Google," which does not correspond to the advertised Facebook brand and suggests a mismatch between the title and the intended lure.

The site was flagged by Google Safe Browsing for social engineering, and 13 of 95 VirusTotal scanners labeled the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and current monitoring confirms the host is no longer reachable. Nameserver data could not be retrieved (NS_NOT_FOUND), limiting the ability to assess DNS‑level abuse patterns.

Defenders should immediately block the associated IP address and add flow.beefyhubs.life to internal URL filtering rules. Continuous monitoring of Cloudflare‑registered domains and the specific IP range is advised, as the actor may redeploy the campaign using alternative subdomains or similar registration tactics. Email gateways should be configured to flag any messages referencing Facebook login prompts that originate from non‑official Facebook domains, and security teams should educate users about the discrepancy between expected brand content and unexpected page titles such as "Google" that may appear in malicious links.