sophon[.]beefyhubs[.]cfd

Analysis indicates that the domain sophon.beefyhubs.cfd was registered on October 21, 2025 through Dynadot LLC and is currently resolved to the IP address 142.251.40.164, which belongs to AS15169 Google LLC in the United States. The domain has been identified as a brand‑impersonation campaign targeting Facebook, although the only visible page title returned from the host is “Google”, suggesting a mismatch between the advertised brand and the content served. No TLS certificate was observed, meaning the site operates over plain HTTP, which further reduces credibility and enables easy interception.

VirusTotal reports six positive detections out of ninety‑five scanners, and Gridinsoft assigns a trust score of zero out of one hundred, confirming a high likelihood of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, after which its status was reported as offline. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure, a common choice for fast‑deployment phishing sites.

The elevated risk rating aligns with the observed indicators, but the lack of a valid SSL certificate and the offline status limit current exploitation potential. Defenders should add sophon.beefyhubs.cfd to web‑filter and DNS blocklists, monitor the associated IP range for any future re‑use, and consider flagging similar Cloudflare‑based domains that resolve to Google’s IP space while claiming to impersonate social media brands. Continued observation is recommended to capture any re‑activation attempts or related infrastructure that may appear in subsequent campaigns.