sca[.]beefy-hub[.]sbs

Analysis of sca.beefy-hub.sbs, observed on July 23, 2026, indicates that the domain was registered through Dynadot LLC on 25 October 2025 and subsequently pointed to the IP address 142.250.185.100, which belongs to the AS15169 block owned by Google LLC in the United States. The site presented a page title of “Google,” matching the declared brand target of Google and the listed scam type of brand impersonation. No TLS certificate was detected, meaning the site operated without HTTPS encryption. The domain’s authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated.

Gridinsoft assigned a trust score of zero out of one hundred, and the domain appears on a single security blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. VirusTotal scans show that eleven of ninety‑five antivirus engines flagged the domain, providing additional corroboration of malicious intent. The limited detection footprint, combined with the lack of SSL and the low trust rating, suggests a deliberate attempt to mimic Google’s brand for credential harvesting or other fraudulent activity.

Uncertainties remain regarding the exact content served before takedown, the presence of any additional infrastructure such as command‑and‑control servers, and whether the domain was part of a larger campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future subdomains that resolve to the same IP range, and update internal threat‑intel feeds with the observed indicators, including the registrar, nameservers, IP address, and the VirusTotal detection count. Ongoing vigilance is recommended because brand‑impersonation actors often recycle infrastructure after takedown.