akt[.]beefyhubs[.]sbs

Analysis of akt.beefyhubs.sbs shows that the domain was registered through Dynadot LLC on 21 Oct 2025 and is presently taken offline. The site resolves to IP 142.250.185.68, an address owned by AS15169 Google LLC in the United States, indicating that the attacker leveraged infrastructure that belongs to Google’s network, a technique often used to increase credibility. The domain’s authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed, which is consistent with rapid provisioning of malicious sites. No TLS certificate was presented, leaving the site without HTTPS protection, and the page title returned simply “Google”, matching the declared brand impersonation target.

VirusTotal records indicate that 15 of 95 scanned security vendors flagged the domain as malicious, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. While the site is no longer reachable, the combination of a Google‑owned IP, Cloudflare nameservers, a low trust score, and multiple vendor detections provides strong evidence of a brand‑impersonation campaign aimed at Google users.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any future re‑registration of the same second‑level name, and add the IP address to watchlists for potential abuse. Additional investigation of traffic logs for requests to 142.250.185.68 during the active window may reveal compromised accounts or credential harvesting attempts. Because the site’s content beyond the title has not been captured, analysts should treat any related URLs or similar subdomains as high‑risk until verified safe.