degen[.]beefy-hub[.]sbs

On July 23, 2026, the domain degen.beefy-hub.sbs was observed offline but retains multiple indicators of malicious use. The domain was registered on October 25, 2025 through Dynadot LLC and is hosted on the IP address 142.251.167.105, which belongs to AS15169 Google LLC in the United States. DNS resolution is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is presented, meaning the site would have been served over plain HTTP if active. The page title returned at the time of collection was “Google”, providing no direct reference to the alleged target.

The domain is classified as a brand‑impersonation campaign targeting Facebook, and Google Safe Browsing lists it as a social‑engineering threat. VirusTotal analysis shows that 16 of 95 scanning engines flagged the domain, and it appears on one external blocklist that has been incorporated by PhishDestroy, which also listed the domain as blocked. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious behavior. The combination of a recent registration, lack of TLS, low trust score, and multiple vendor detections strongly suggests that the site was used to deceive users into providing Facebook credentials or related personal data.

Because the site is currently offline, active mitigation is limited to preventive measures. Security operations should add degen.beefy-hub.sbs to inbound and outbound filtering rules, update URL block lists, and monitor related DNS queries for any resurgence. Incident response teams should also review any recent traffic logs for connections to the IP address 142.251.167.105 or the Cloudflare nameservers associated with this domain. Continued observation of the registrar Dynadot and the hosting AS for new domains with similar naming patterns is recommended to detect potential re‑use or copycat campaigns.