cetus[.]beefyhubs[.]click

Analysis of cetus.beefyhubs.click indicates that the domain was registered on 22 October 2025 through Dynadot LLC. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to IP address 172.253.62.99, which is announced by AS15169, owned by Google LLC, and geolocated to the United States. The lack of an SSL/TLS certificate means the site would have been served over plain HTTP, which is atypical for a credential‑harvesting portal but consistent with a quickly deployed impersonation page. The page title returned by the server is “Google”, matching the declared brand target and confirming the intent to masquerade as a Google service.

Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low reputation. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal scans show that three of ninety‑five antivirus or URL‑reputation engines flagged the domain, providing independent corroboration of malicious intent. The site is currently offline, which limits real‑time observation, and no further content has been captured.

Defenders should continue to block the domain at perimeter filters, add the IP address 172.253.62.99 to deny lists, and monitor for any future re‑registration of the same second‑level domain or similar sub‑domains under the beefyhubs.click zone. Because the registration information, DNS infrastructure, and limited vendor detections are publicly available, threat‑intel platforms can enrich indicators of compromise with the registrar, name‑server, and IP details to improve detection of related campaigns. Uncertainty remains regarding the exact payload or credential‑capture mechanism, as no SSL certificate or page content was observed before the takedown.