nexusmutual[.]beefyhubs[.]life

Analysis indicates that the domain nexusmutual.beefyhubs.life was registered on October 26, 2025 through Dynadot LLC and is presently taken offline. The domain resolves to IP address 142.250.185.164, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite sharing the same autonomous system as legitimate Google services, the domain hosts no SSL certificate, and its HTTP response is not publicly observable because the site is offline. The page title returned when the domain was reachable was simply "Google," aligning with the declared brand target of Google and the scam type of brand impersonation.

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating a highly untrusted reputation. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy, confirming that at least one anti‑phishing service has flagged it. VirusTotal scans recorded 13 detections out of 95 participating security vendors, providing additional corroboration of malicious intent.

The limited detection footprint—one blocklist entry and modest vendor count—means that broader visibility may be lacking, and the exact payload or phishing workflow remains uncertain because the site is no longer active. Defenders should immediately add nexusmutual.beefyhubs.life to DNS and URL filtering rules, monitor for any resurgence of the domain or similar sub‑domains under the beefyhubs.life TLD, and consider extending surveillance to other domains resolving to Google‑owned IP ranges that lack TLS certificates. Continuous threat‑intel feeds should be consulted for new indicators, and any inbound traffic to the IP should be logged for anomalous activity tied to brand‑impersonation campaigns.