arb[.]beefyhubs[.]sbs

This domain, arb.beefyhubs.sbs, was registered on 21 October 2025 through Dynadot LLC and uses the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.186.164, an address owned by AS15169 Google LLC located in the United States. The hosting infrastructure therefore appears to be a legitimate Google IP range, which is a common tactic for brand‑impersonation campaigns seeking to lend credibility. No TLS certificate is presented; the site serves HTTP only, which further reduces the appearance of a trustworthy service.

The page title returned from the offline host is “Google”, matching the declared brand target and confirming the intent to masquerade as Google. The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis shows 15 of 95 scanning engines flag the domain as malicious, indicating a moderate level of detection confidence. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification.

The site is currently taken offline, limiting immediate exposure, but historical evidence suggests it was used for brand‑impersonation. Defenders should continue to monitor DNS and IP reputation feeds for this address, add the domain to local deny lists, and enforce strict URL filtering for any traffic to arb.beefyhubs.sbs. Incident response teams should also consider investigating any recent authentication attempts that reference Google credentials from internal users, as credential‑harvesting may have been the underlying objective. Because the infrastructure leverages a legitimate Google IP block, threat hunters should correlate network logs with this specific IP to differentiate benign Google traffic from potential malicious activity.