zeebu[.]beefy-hub[.]sbs

Analysis of the domain zeebu.beefy-hub.sbs indicates a confirmed phishing campaign targeting Facebook users, classified as brand impersonation. The domain was registered on October 25, 2025, through Dynadot LLC, a registrar frequently observed in fraudulent infrastructure. Infrastructure analysis reveals the domain resolves to the IPv6 address 2607:f8b0:4004:c1d::69, hosted under Google LLC (AS15169) in the United States, though this does not inherently confirm malicious intent on the provider's part. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggest Cloudflare protection, a common tactic to evade takedowns and obscure hosting origins.

Notably, the domain lacks an SSL certificate, increasing the likelihood of interception or detection by security tools. The page title, recorded as 'Google,' contrasts with the domain's stated intent to impersonate Facebook, though the exact content of the phishing page remains unanalyzed. Detection metrics from July 23, 2026, show 16 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification.

The domain is currently offline, though its prior activity and infrastructure warrant continued monitoring. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Facebook access is common. Given the use of Cloudflare nameservers and Google-hosted infrastructure, organizations may also investigate associated IPs and registrar patterns for broader threat hunting. While the domain is inactive, its registration details and detection history suggest potential for reactivation or reuse in future campaigns.