tia[.]beefyhubs[.]sbs

Analysis of the domain tia.beefyhubs.sbs, created on 21 October 2025 and currently reported offline, indicates a brand‑impersonation campaign targeting Google. The domain is registered through Dynadot LLC and resolves to the IP address 142.250.185.164, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate was observed, meaning the site would have been served over plain HTTP. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, showing the use of Cloudflare’s DNS infrastructure.

VirusTotal scans show that seven of ninety‑five antivirus and URL‑reputation engines flagged the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has already blocked the host, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The page title returned by the web server is “Google”, matching the declared brand target.

The limited detection footprint—only one blocklist entry and a modest number of vendor flags—suggests the site was short‑lived before being taken offline. Defenders should continue to monitor DNS queries for the domain and its associated IP range, enforce outbound filtering to prevent connections to the IP, and consider adding the domain to local deny lists. Additional investigation of any related subdomains hosted on the same Cloudflare nameservers may reveal further infrastructure used in the campaign.