flx[.]beefy-hub[.]sbs

The domain flx.beefy-hub.sbs is flagged as a high‑risk brand‑impersonation site targeting Facebook users. Infrastructure analysis shows the domain resolves to IP 172.253.62.99, an address owned by Google LLC (AS15169) located in the United States. The domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. Registration data reveals the domain was created on 25 October 2025 through Dynadot LLC, a registrar known to host both legitimate and malicious domains.

No TLS certificate is presented, meaning traffic is unencrypted and susceptible to interception. The page title returned by the HTTP response is "Google," which does not align with the claimed Facebook impersonation and suggests a mismatch between content and intended lure. Detection data shows that 10 of 95 security vendors on VirusTotal have flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The Gridinsoft trust score is 0 out of 100, and the domain appears on one external blocklist.

PhishDestroy has already taken the domain offline, but remnants of the infrastructure may persist in cached DNS records or client hosts that previously accessed the site. Defenders should immediately add flx.beefy-hub.sbs to network and endpoint blocklists, enforce DNS sinkholing for the associated IP, and monitor for any resurgence of the domain or related subdomains. Given the lack of SSL and the presence of a generic page title, automated content inspection is unlikely to reveal additional malicious payloads, so reliance on reputation and network‑level controls is advised. Continuous monitoring of Dynadot‑registered domains that resolve to Google‑owned IP ranges can help detect similar brand‑impersonation campaigns in their early stages.