bnc[.]beefyhub[.]sbs

Analysis of the domain bnc.beefyhub.sbs, registered on October 19, 2025, indicates it was actively impersonating Google as part of a brand impersonation phishing campaign. The domain resolved to the IP address 142.250.186.68, which is geolocated in Germany under AS15169 (Google LLC), though this does not confirm hosting by Google itself. Infrastructure analysis reveals the domain used Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and lacked an SSL certificate, increasing its detectability as malicious. The page title was explicitly set to 'Google,' aligning with the reported brand target.

Detection data shows the domain appeared on one security blocklist (PhishDestroy) and was flagged by 6 of 95 security vendors on VirusTotal. Gridinsoft assigned a trust score of 0/100, further supporting its classification as high-risk. The domain was taken offline by July 23, 2026, but defenders should treat it as part of a broader pattern of Google-branded phishing infrastructure. No evidence links this domain to a specific phishing kit or additional scam subtypes (e.g., credential harvesting, malware distribution).

The registrar, Dynadot LLC, is consistent with domains used in prior phishing operations, though this alone is not conclusive. Defenders are advised to block the domain and its resolving IP at network and endpoint levels, monitor for related infrastructure (e.g., subdomains or newly registered lookalike domains), and review logs for connections to 142.250.186.68 during the period it was active. The absence of SSL and reliance on Cloudflare nameservers may serve as indicators for future detections. Further investigation into the actor behind this domain is warranted, particularly given its short lifespan and targeting of a high-value brand.