hubs-beefy[.]cfd

The domain hubs-beefy.cfd is currently listed as offline but retains a high‑risk profile due to confirmed brand‑impersonation activity targeting Google. Registration data shows the domain was created on November 05, 2025 through Dynadot LLC, and it resolves to IP address 142.250.186.164, which belongs to AS15169 Google LLC in the United States. Despite resolving to a Google‑owned IP, the site does not present an SSL certificate, exposing any traffic to potential interception. The page title returned by the server is exactly "Google," matching the declared brand target and confirming the impersonation intent.

Google Safe Browsing has flagged the domain for social engineering, and fifteen of ninety‑five VirusTotal scanners have identified it as malicious, reinforcing the suspicion of malicious use. The Gridinsoft trust score is 0 out of 100, indicating a complete lack of credibility. Infrastructure analysis shows the domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common choice for fast‑changing malicious sites. The domain appears on one external security blocklist and has been explicitly blocked by PhishDestroy, providing at least one source of detection for defenders.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no detailed page content has been captured and the site lacks TLS, limiting visibility into any active malicious code. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and enforce strict TLS inspection for any outbound connections to the associated IP. Given the high risk, adding hubs-beefy.cfd to internal blocklists and sharing the indicator with threat‑intel sharing platforms is recommended to prevent inadvertent user exposure.