wct[.]beefy-hub[.]sbs

Analysis of wct.beefy-hub.sbs indicates a confirmed brand impersonation campaign targeting Google, classified as elevated risk. The domain was registered on October 25, 2025, through Dynadot LLC and configured with Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). At the time of assessment, the domain resolved to IP 142.250.188.4, an address assigned to AS15169 (Google LLC) in the United States, though this does not imply endorsement or hosting by Google. No SSL certificate was present, increasing the likelihood of interception or tampering during transmission.

The page title was explicitly set to 'Google,' aligning with the reported brand impersonation scam type. Detection by 15 of 95 security vendors on VirusTotal further corroborates malicious intent, though the absence of additional context limits attribution to a specific threat actor or campaign. The domain appears on one security blocklist and was actively blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk.

Infrastructure analysis reveals the domain was taken offline prior to this report, though historical resolution to a Google-owned IP may indicate prior abuse of legitimate services or misconfigured hosting. Defenders should treat this domain as compromised and prioritize blocking at the DNS and network layers. Monitoring for re-registration or similar patterns (e.g., Cloudflare nameservers, Dynadot registrations, or Google-themed page titles) is recommended. No evidence of a phishing kit or additional scam categorization (e.g., credential harvesting, malware distribution) was provided, limiting further technical attribution.