strk[.]beefyhubs[.]life

strk.beefyhubs.life was registered on 26 October 2025 through Dynadot LLC. The domain resolves to the IP address 142.250.185.132, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting infrastructure is therefore owned by Google, but the domain lacks an SSL/TLS certificate, which is atypical for legitimate Google services. The page title returned by the HTTP response is simply “Google”, matching the declared brand target. VirusTotal has recorded 14 detections out of 95 scanned security vendors, indicating a consensus among scanning engines that the domain is malicious.

The Gridinsoft trust score of 0 out of 100 further corroborates a high‑risk assessment. The domain appears on a single public blocklist, PhishDestroy, which has already taken the site offline. The risk level is elevated and the current status is offline, suggesting that mitigation actions have been applied but that the infrastructure may be reused for future campaigns. Analysis of the available indicators shows a classic brand‑impersonation pattern: the use of the Google brand in the page title, the registration of a relatively new domain, and the deployment on infrastructure owned by the targeted brand to increase credibility.

Defenders should ensure that the domain is added to DNS and proxy deny lists, monitor for any resurgence of the same domain or similar sub‑domains resolving to the same IP range, and consider extending blocklist rules to cover newly registered domains that resolve to Google‑owned IP blocks but lack TLS. Continuous review of threat‑intel feeds for additional detections, especially from other blocklists or safe‑browsing services, is recommended. Because the IP is part of Google’s public address space, blanket blocking of the entire prefix is not advised; instead, focus on the specific FQDN and any future domains that exhibit the same registration and content patterns.