nexusmutual[.]beefy-hub[.]lol

Analysis of nexusmutual.beefy-hub.lol confirms its classification as a brand impersonation phishing domain targeting Google. The domain, registered on October 25, 2025, through Dynadot LLC, resolved to IP address 142.250.188.4, which is geolocated in the United States and associated with AS15169 (Google LLC). This IP alignment with the legitimate brand's infrastructure suggests an attempt to blend with expected network patterns, though the domain itself remains unauthorized. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com indicate Cloudflare DNS management, a common practice among both legitimate and malicious actors to obscure hosting origins.

The domain's page title was recorded as 'Google', directly matching the impersonated brand. No SSL certificate was detected, increasing the likelihood of interception or user distrust. Detection metrics show the domain appeared on one security blocklist, specifically PhishDestroy, and was flagged by 16 of 95 security vendors on VirusTotal, reinforcing its malicious classification. Gridinsoft assigned a trust score of 0/100, further corroborating its fraudulent nature.

Infrastructure analysis reveals the domain was taken offline by July 23, 2026, though its prior activity remains a documented risk. Defenders should treat any prior resolution to 142.250.188.4 or association with the domain as indicators of compromise. Organizations are advised to block the domain at the DNS and proxy levels, monitor for residual connections, and review logs for prior access attempts. The absence of an SSL certificate and the use of a high-reputation IP address underscore the need for layered detection mechanisms beyond simple reputation checks.