magma[.]beefyhubs[.]sbs

Analysis of magma.beefyhubs.sbs, created on October 21, 2025 and currently taken offline, shows a clear pattern of brand impersonation targeting Google. The site presented a page title of "Google" and was classified as a Google impersonation in the intelligence feed. Technical infrastructure reveals the domain is hosted on Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and resolves to the IPv6 address 2607:f8b0:4004:c19::69, which belongs to AS15169 Google LLC in the United States. The IP ownership indicates the adversary leveraged legitimate Google infrastructure, a tactic that can increase trust among victims and complicate detection.

No SSL certificate was observed, meaning the site operated without HTTPS, which is atypical for a domain hosted on Cloudflare but consistent with a quickly deployed phishing landing page. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal scans recorded 14 detections out of 95 security vendors, reinforcing the malicious assessment. Registration was performed through Dynadot LLC, a registrar commonly used for both legitimate and malicious domains.

While the site is offline, the combination of a Google‑related page title, brand impersonation label, Cloudflare name servers, and a Google‑owned IP address provides sufficient evidence to treat this domain as a confirmed phishing infrastructure component. Defenders should continue to block the domain at network perimeter controls, add it to internal threat intelligence feeds, and monitor the associated IP range for any re‑use. Given the use of a legitimate Google AS, additional scrutiny of outbound traffic to this address is advised to detect possible resurgence. Ongoing observation of the registrar’s activity and the Cloudflare name server configuration may reveal future campaigns employing similar tactics.