bob[.]beefyhubs[.]click

bob.beefyhubs.click is currently offline, which prevents immediate interaction but historical evidence indicates it was used for brand impersonation of Google. The domain was registered through Dynadot LLC on 22 October 2025 and resolves to the IP address 172.253.62.105, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com point to Cloudflare’s DNS infrastructure, a common choice for fast‑flux or disposable phishing sites. No TLS certificate was observed, meaning any HTTP connection would have been unencrypted.

The page title returned by the server was simply “Google”, matching the declared brand target and confirming the intent to masquerade as the search giant. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious use. VirusTotal scans recorded four positive detections out of ninety‑five scanning engines, and the domain appears on one external blocklist and is listed as blocked by PhishDestroy. The combination of a recent creation date, use of a reputable hosting ASN, lack of SSL, low trust score, and multiple vendor detections aligns with typical infrastructure for credential‑stealing or login‑capture campaigns that claim to be Google services.

Because the site is offline, active payloads cannot be confirmed, and the exact content of the landing page has not been captured, leaving the precise phishing vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IP address 172.253.62.105 to threat‑intel feeds as a suspicious Google‑associated host when observed outside of Google’s official services. Ongoing correlation with other Cloudflare‑hosted domains that share the same nameservers may reveal additional campaign infrastructure.