fil[.]beefy-hub[.]lat

The domain fil.beefy-hub.lat was registered through Dynadot LLC on October 25 2025. Its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS. DNS resolution returns a single IPv6 address 2607:f8b0:4004:c1d::68, which is announced by AS15169 Google LLC and geolocated to the United States. No TLS certificate is presented, so connections are unencrypted. Public threat intelligence services have flagged the domain.

Google Safe Browsing labels it as a social engineering site, and the Gridinsoft trust score assigns a value of 0 out of 100. VirusTotal reports that 13 of 95 scanned security vendors flagged the domain as malicious. It appears on one external blocklist and has been taken down by the PhishDestroy takedown service. The page title returned from the HTTP response is “Google”, matching the declared brand target and confirming the classification as a brand‑impersonation campaign aimed at Google.

The evidence confirms that the infrastructure is deliberately crafted to masquerade as a Google resource, yet the site is currently offline, limiting immediate exposure. Open questions remain regarding the content that was served before takedown, the presence of any credential‑harvesting forms, and whether additional malicious infrastructure (e.g., command‑and‑control servers) is associated with the same IP block. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IPv6 address to existing threat‑intel feeds. Automated scanners should treat any future resolution of this address as high‑risk, and incident response teams should verify that no credential data has been exfiltrated from users who may have visited the site prior to takedown.