ton[.]beefyhubs[.]sbs

On July 23, 2026 analysts examined the domain ton.beefyhubs.sbs, which was created on October 21, 2025 and is currently offline. The site presented the page title “Google” and is classified as a brand‑impersonation campaign targeting Google. No TLS certificate is associated with the host, indicating that any HTTP service would have been delivered without encryption. DNS resolution points to 142.250.186.164, an address owned by AS15169, Google LLC, located in the United States.

The domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and was registered through Dynadot LLC. Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the host, and VirusTotal records indicate that 15 of 95 scanning engines flagged the domain as malicious. The available intelligence does not include a Safe Browsing verdict, Open Threat Exchange entries, or detailed payload analysis, so the exact malicious content remains unknown.

Defenders should add ton.beefyhubs.sbs to inbound and outbound deny lists, monitor DNS queries for the associated IP address, and enforce TLS inspection for any residual traffic. Continuous re‑scanning is advised to capture any future re‑activation, and alerts should be generated for new domains that resolve to the same Cloudflare name servers or share the registration path through Dynadot. The combination of brand impersonation, low trust score, blocklist presence, and multi‑vendor detection strongly suggests a high‑confidence phishing operation, warranting immediate remediation.