dbr[.]beefy-hub[.]sbs

On 25 October 2025 the domain dbr.beefy-hub.sbs was registered through Dynadot LLC. The zone is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com and resolves to the IP address 142.250.181.228, which belongs to AS15169 (Google LLC) and is geolocated in the United States. No TLS certificate is presented for the host, indicating that HTTPS is not configured. The site’s HTML title is "Google", and the threat profile classifies the content as a brand‑impersonation campaign targeting Google. Google Safe Browsing has flagged the domain for social‑engineering, and it appears on one external security blocklist.

PhishDestroy has taken the domain offline, and the current status is reported as taken offline. VirusTotal analysis shows that 15 of 95 scanning engines return a malicious classification for the domain. The combination of a legitimate‑looking IP range, lack of SSL, and brand‑related page title is a typical pattern used to increase credibility while evading certificate‑based checks.

Defenders should continue to block the domain at perimeter filters, add the IP address 142.250.181.228 to reputation lists, and monitor for new sub‑domains under the beefy‑hub.sbs parent zone that may reuse the same name servers. Ongoing reconnaissance of the registrar Dynadot LLC for other recently created domains with similar naming conventions is recommended, as is periodic re‑scanning of the IP range for re‑activation of phishing infrastructure. Because the host is currently offline, immediate containment is achieved, but the underlying infrastructure remains under the control of the same Cloudflare name‑server configuration, which could be repurposed for future campaigns.