graph[.]beefyhubs[.]sbs

graph.beefyhubs.sbs was registered on 21 October 2025 through Dynadot LLC. The domain currently resolves to the IP address 142.250.186.132, which is announced by AS15169 and belongs to Google LLC in the United States. The name servers listed for the zone are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the domain is fronted by Cloudflare’s DNS infrastructure. An HTTP request to the host returned a page whose title is simply “Google”, matching the declared brand target. No TLS certificate was presented, meaning the site is served over plain HTTP.

The site has been classified as a brand‑impersonation campaign that mimics Google, and it is listed as blocked by the PhishDestroy feed. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded 13 detections out of 95 scanned engines. The domain appears on one additional security blocklist. As of the report date, the site is offline, but the underlying infrastructure – a Google‑owned IP behind Cloudflare DNS – remains reachable and could be re‑activated by the threat actors.

The convergence of a reputable hosting IP, Cloudflare name servers, and the lack of TLS creates a low‑cost hosting vector that can be leveraged for short‑lived phishing pages. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host, and add the associated IP address to any outbound filtering rules that inspect traffic to Google‑owned ranges for anomalous use. Ongoing intelligence collection should watch for new sub‑domains that reuse the same Cloudflare name servers or similar registration patterns, as these may indicate a broader impersonation campaign.