eul[.]beefy-hub[.]lat

The domain eul.beefy-hub.lat was first observed on October 25, 2025 and is currently listed as offline. It was registered through Dynadot LLC and delegated to the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The site resolved to the IP address 142.250.181.228, which belongs to AS15169 owned by Google LLC and is located in the United States. No TLS certificate was presented for the host, and attempts to establish an HTTPS connection would therefore fail.

The single page that was reachable presented the title "Google", matching the declared brand target of Google. The activity was classified as a brand‑impersonation campaign. Google Safe Browsing flagged the domain for social engineering, and PhishDestroy has added it to its blocklist. The domain also appears on one additional security blocklist, and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence of malicious intent.

VirusTotal reports that 14 of 95 scanned security engines flagged the domain as malicious, providing further corroboration of its threat profile. No SSL/TLS certificate was observed, and the HTTP status at the time of analysis is not documented; the site was taken offline before a full content capture could be performed, so the exact payload or credential‑collection mechanisms remain unknown. Defenders should block eul.beefy-hub.lat at the DNS and proxy layers, monitor for any residual traffic to the underlying IP address 142.250.181.228 that could be leveraged by other malicious actors, and ensure that corporate users are warned about unsolicited communications purporting to originate from Google. Incident response teams should also verify that any previously captured credentials associated with this domain are treated as compromised.