aethir[.]beefy-hub[.]lol

Analysis of the domain aethir.beefy-hub.lol indicates that it was registered on 25 October 2025 through Dynadot LLC. The site resolves to IP 142.250.185.196, which belongs to AS15169 Google LLC located in the United States. The page title returned by the server is "Google", and the campaign is classified as brand impersonation targeting Google. Google Safe Browsing flags the domain for social engineering, and VirusTotal records show that 15 of 95 security vendors have flagged it as malicious. No SSL certificate is present, leaving the connection unencrypted.

A Gridinsoft trust score of 0/100 further confirms the low credibility of the host. The domain appears on one security blocklist and has been blocked by the PhishDestroy mitigation service. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS infrastructure. The current operational status is offline, suggesting the actors have taken the site down, but the identified infrastructure artifacts remain valuable for attribution and future detection.

Uncertainty persists regarding the specific phishing kit or payload employed, as no additional forensic details are available. Defenders should continue to block the domain at network perimeters, incorporate the observed indicators into URL filtering and threat‑intel feeds, and monitor for any re‑registration attempts that reuse the same registrar or hosting ASN. Correlating this indicator set with other Google‑impersonation observations may reveal shared tooling or command‑and‑control patterns.