spaceandtime[.]beefyhubs[.]sbs

Analysis of the domain spaceandtime.beefyhubs.sbs confirms its classification as a brand impersonation phishing site targeting Google. The domain was registered on October 21, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals the domain resolved to the IPv6 address 2a00:1450:4001:80f::2004, which is associated with AS15169 (Google LLC) in Germany. However, this IP resolution does not align with typical hosting patterns for phishing sites impersonating Google, suggesting potential misconfiguration or deliberate obfuscation. The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns.

Security vendor detections on VirusTotal indicate that 6 out of 95 engines flagged the domain as malicious, providing moderate confidence in its classification as phishing infrastructure. The domain appears on at least one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0/100, further corroborating its malicious nature. The absence of an SSL certificate is notable, as legitimate Google services universally employ HTTPS. The page title, 'Google,' directly aligns with the brand impersonation scam type identified in the intelligence data. Defenders should treat this domain as confirmed phishing infrastructure.

The combination of brand impersonation, low trust scores, and blocklist presence justifies immediate blocking at the DNS or network level. While the domain is currently offline, historical resolution data and registration details should be preserved for threat hunting and retrospective analysis. No evidence links the domain to a specific phishing kit or campaign beyond the Google brand impersonation, and the exact content or payload delivered remains unanalyzed. Further investigation into the Cloudflare configuration and IP resolution history may yield additional indicators of compromise.