stellar[.]beefyhubs[.]sbs

Analysis as of July 25 2026 indicates that the domain stellar.beefyhubs.sbs was registered on 21 October 2025 through Dynadot LLC. The domain resolves to IP address 142.250.186.68, which belongs to AS15169 owned by Google LLC and is geolocated in Germany. The hosting infrastructure is fronted by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed, meaning the site was served over HTTP only. The page title returned by the HTTP response is “Google”, and the intelligence classification lists the scam type as brand impersonation targeting Google. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain as malicious, corroborating the blocklist findings. The current operational status is offline, indicating that the host has been taken down or otherwise rendered inaccessible. Evidence confirms that the domain is being used for brand impersonation of Google, but the specific payload or credential‑collection mechanism has not been publicly disclosed.

Because the IP address is owned by Google, the malicious activity likely leveraged compromised or abused cloud resources rather than a dedicated malicious server. Defenders should continue to block stellar.beefyhubs.sbs at DNS and network perimeter filters, monitor for any resurgence of the domain, and consider adding the associated IP address to reputation lists pending further verification. Additional investigation of HTTP traffic logs for attempts to resolve the domain before its takedown may reveal victim targeting patterns. Continuous review of PhishDestroy and other anti‑phishing feeds is recommended to capture any re‑registration attempts.