mole[.]beefyhubs[.]click

The domain mole.beefyhubs.click was observed targeting the Google brand by presenting a page title of “Google”. The domain was registered on 22 October 2025 through Dynadot LLC and is hosted on the IP address 142.251.140.164, which belongs to AS15169 Google LLC and is geolocated in the United States. Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain, and no TLS certificate was detected, indicating that the site was served over plain HTTP. VirusTotal analysis shows that three of ninety‑five security vendors flagged the domain, and it appears on a single external blocklist that is currently used by PhishDestroy, which has already taken the site offline.

The risk rating assigned is elevated, consistent with the brand‑impersonation classification. The short lifespan of the domain, combined with the lack of SSL, suggests a low‑cost, opportunistic campaign rather than a sophisticated infrastructure. However, the use of a Google‑owned IP range may increase the likelihood of the page being trusted by unsuspecting users, and the presence of Cloudflare DNS may obscure the true origin of the hosting server. At present the site is no longer reachable, but the registration details and DNS configuration remain publicly visible, allowing threat‑intel teams to monitor for future re‑use of the same infrastructure.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any new domains registered by the same registrar that resolve to the same IP range or use the same Cloudflare nameservers. Additional investigation of the three vendor detections may reveal the underlying phishing kit or payload, which could inform broader detection rules. Until further evidence emerges, the domain should be treated as a confirmed brand‑impersonation threat with elevated risk.