crv[.]beefy-hub[.]sbs

Analysis dated July 23, 2026 identifies the domain crv.beefy-hub.sbs as a high‑risk brand‑impersonation site targeting Google users. The domain was registered on 25 October 2025 through Dynadot LLC and is delegated to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.186.164, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate is presented, leaving the site exposed to clear‑text traffic.

The page title returned by the HTTP response is the generic string “Google”, matching the declared brand target and confirming the impersonation intent. Reputation services flag the domain aggressively: Gridinsoft assigns a trust score of 0 out of 100, and Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal reports that 15 of 95 scanned security vendors raise alerts, and the domain appears on at least one public blocklist, including PhishDestroy, which has already taken the site offline. The current HTTP status is offline, preventing live interaction but preserving forensic evidence.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as the page content has not been captured and no SSL/TLS handshake data exist. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host under alternative subdomains, and update detection signatures with the observed IP address and name‑server pair. Incident response teams should also advise users to verify URLs carefully, especially when unexpected “Google” page titles appear, and to report any suspicious redirects to the relevant brand‑abuse channels.