metis[.]beefy-hub[.]sbs

The domain metis.beefy-hub.sbs was registered on 25 October 2025 through Dynadot LLC and is currently flagged as offline. DNS resolution points to 142.251.40.228, an address owned by AS15169 Google LLC in the United States, and the domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, indicating that the site does not offer HTTPS protection.

The HTTP response, captured before the takedown, returned a page title of “Google,” aligning with the declared brand target of Google and confirming a brand‑impersonation intent. VirusTotal scans show that 14 of 95 security vendors have identified the domain as malicious, and the site is listed on at least one public blocklist, with PhishDestroy explicitly blocking it. Because the site is offline, content‑level analysis (e.g., form fields, visual branding, or payload delivery) cannot be verified, leaving the exact phishing kit or payload unknown.

Nonetheless, the combination of a Google‑related page title, registration timing, use of a Google IP address, lack of SSL, and multiple vendor detections provides sufficient evidence to categorize the infrastructure as a confirmed Google brand‑impersonation operation. Defenders should add metis.beefy-hub.sbs to URL filtering and DNS blocklists, monitor for any re‑registration attempts, and enforce strict HTTPS‑only policies to mitigate potential credential harvesting. Continuous threat‑intel feeds should be consulted for any resurgence or related domains that share the same registrar or nameserver configuration.