cetus[.]beefyhubs[.]xyz

Analysis of cetus.beefyhubs.xyz shows a newly created (October 22, 2025) domain that attempts to impersonate Google, as indicated by the page title "Google" and the declared brand target. The domain resolves to IP address 142.250.184.228, which belongs to ASN 15169 owned by Google LLC and is located in the United States. Hosting is provided through Cloudflare, with authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Registration was performed via Dynadot LLC, a common registrar for both legitimate and malicious domains.

No TLS certificate was observed, meaning the site does not offer encrypted connections. Threat intelligence flags the domain as a brand‑impersonation scam; 14 of 95 security vendors on VirusTotal have issued detections, and the domain appears on one external blocklist, which has already been incorporated by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is currently taken offline, but the infrastructure remains observable and could be re‑activated. Defenders should block the domain at DNS and proxy layers, add it to internal and external blocklists, and monitor the associated IP for any future activity. Continuous re‑query of reputation services is advised to capture any changes in detection status.