momentum[.]beefyhubs[.]click

momentum.beefyhubs.click was observed to resolve to the IP address 142.251.163.147, which belongs to AS15169 owned by Google LLC and is located in the United States. The domain was registered on October 22, 2025 through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented during connection attempts, indicating the site was served over plain HTTP. The page title returned by the HTTP response is "Google", and the domain is explicitly listed as impersonating the Google brand.

PhishDestroy has already taken the domain offline, and it currently appears on a single security blocklist. VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, confirming its malicious nature. The limited detection footprint suggests a short‑lived campaign, but the use of legitimate Google infrastructure for hosting raises the risk of trust exploitation.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the domain or similarly structured subdomains, and consider adding the domain to internal threat intelligence feeds. Additional investigation of HTTP payloads, redirects, and any associated URLs would be required to fully map the phishing infrastructure, but such content is not presently available. Until the domain is confirmed clean, it should be treated as malicious and excluded from user access.