graph[.]beefyhubs[.]cfd

The domain graph.beefyhubs.cfd was observed targeting the Google brand through a page whose HTML title is exactly “Google”. Registration data indicates the domain was created on 21 October 2025 and is hosted by Dynadot LLC. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, which resolve the domain to the IPv4 address 142.250.186.68. The IP address is assigned to AS15169, Google LLC, and geolocates to Germany. No TLS certificate is presented, meaning the site is served over plain HTTP only.

VirusTotal analysis shows that ten of ninety‑five scanning engines flagged the domain as malicious. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has already taken action to block the domain, and the current HTTP status is offline. The available evidence confirms a brand‑impersonation campaign that attempts to masquerade as Google, likely to harvest credentials or deliver further payloads.

Because the domain is already offline, immediate mitigation focuses on ensuring that network‑level controls continue to deny any future resolution of the host. Defenders should add the domain to local DNS blocklists, update firewall and proxy rules to drop traffic to 142.250.186.68, and monitor for any resurgence of similarly structured sub‑domains under the same registrar or name‑server pair. Continuous observation of Dynadot‑registered domains created after October 2025 that resolve to Google‑owned ASes is recommended. The lack of SSL, low trust score, and multiple vendor detections collectively indicate a high confidence malicious classification despite the temporary offline state.