metis[.]beefy-hub[.]lat

metis.beefy-hub.lat was registered on 25 October 2025 via Dynadot LLC. The domain resolves to 142.250.191.4, an address owned by Google LLC (AS15169) located in the United States. Despite the IP belonging to Google’s infrastructure, the domain is not associated with any legitimate Google service; instead it is listed as a brand‑impersonation case targeting Google. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS. No TLS certificate is presented, and HTTP requests return no secure connection, which is typical for many short‑lived phishing infrastructure. VirusTotal records show that 12 of 95 scanning engines have flagged the domain, confirming malicious intent.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. The only visible page element is the HTML title “Google”, matching the declared brand target. The site was taken offline before the time of this report, and no further content was retrieved. Evidence gaps include the lack of a captured landing page, absence of Safe Browsing or Open Threat Exchange indicators, and no publicly disclosed phishing kit attribution. The lack of an SSL certificate means browsers will flag the connection as insecure, which can be leveraged by security tools to drop traffic.

Because the IP belongs to Google, some network‑level allowlists may inadvertently permit traffic, highlighting the need for domain‑based filtering. The presence on PhishDestroy indicates that at least one sinkhole has captured traffic, providing additional confidence in the malicious classification. Defenders should continue to monitor the domain’s name servers and IP address for any re‑use, enforce blocklist updates in web filtering solutions, and ensure that any residual DNS records are purged.