sophon[.]beefy-hub[.]sbs
“Google”
sophon.beefy-hub.sbs — Contenuto non disponibile (HTTP 502). Simulazione del marchio: Google; Tipo di truffa: Brand Impersonation. Riepilogo delle prove: VirusTotal 15/95 (ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CRDF); PhishDestroy score 95/100. Registrar: Dynadot.
L’analisi dettagliata di PhishDestroy AI resta in inglese per preservare il rapporto forense originale.
Analysis as of July 23 2026 indicates that the domain sophon.beefy-hub.sbs is actively being leveraged for a Google brand impersonation campaign. The site presented a page title of “Google”, matching the declared target brand. The domain was registered through Dynadot LLC on October 25 2025 and is served from the IP address 142.251.40.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting infrastructure uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed, meaning the site operated over plain HTTP. VirusTotal scans returned 15 detections out of 95 security vendors, confirming that a substantial portion of the scanning community classifies the domain as malicious.
PhishDestroy has already added the domain to its blocklist, and it appears on one additional security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, further indicating a high confidence of malicious intent. The domain is currently offline, which may be the result of takedown actions or temporary hosting changes. Uncertainties remain regarding the exact content served before the takedown, as no screenshot or HTML capture is available in the current intelligence set. The lack of an SSL certificate prevents verification of certificate‑based fingerprinting, and the short registration age limits the ability to assess long‑term infrastructure patterns.
Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include sophon.beefy-hub.sbs, and monitor for any re‑registration attempts. Because the IP address belongs to Google’s own range, reliance on IP reputation alone could produce false positives; therefore, correlation with domain‑level indicators such as the observed page title, the VirusTotal detection count, and the Gridinsoft score is recommended.
Pipeline di risposta alle minacce
Stato della lista di blocco pubblica
Acquisizione salvata
Analisi dei domini
Dettagli tecniciDNS, SAN SSL, timestamp
ZONA SHORTDOT · PROVE PUBBLICHE
.sbs
ShortDot zone evidence
ShortDot zone evidence
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
ICANN OVERSIGHT
Registration: beefy-hub.sbs
Accreditamento e contesto RAA
Accreditamento e contesto RAA
Registrar accreditation and DNS abuse obligations
For the registrable domain beefy-hub.sbs behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Informazioni forensi
Analisi di VirusTotal
Dati e relazioni esterne
Questo sito ti ha influenzato in qualche modo?
Se hai inserito credenziali dell'account, informazioni personali o di pagamento oppure hai scaricato un file da questo dominio, agisci immediatamente. Di seguito sono riportate le risorse per aiutarti a segnalare l'incidente e proteggerti.
Segnalalo alle autorità locali
Seleziona il tuo Paese per ottenere contatti ufficiali del crimine informatico o creare una bozza di reclamo →.
Verifica qualsiasi dominio
Analisi delle minacce utilizzando blocklist archiviate, WHOIS, DNS e prove di scansione pubblica
Scansiona oraSegnala un tentativo di phishing
Segnala i domini sospetti al nostro database delle minacce — proteggi la comunità
SegnalaFeed in tempo reale sulle minacce
Segnalazioni recenti di phishing e modifiche osservate della disponibilità
MonitoraRimani informato, rimani al sicuro
Controlla le minacce in tempo reale oppure contesta questa segnalazione se ritieni che si tratti di un falso positivo