fil[.]beefy-hub[.]sbs

Analysis of fil.beefy-hub.sbs shows a recent registration (25 Oct 2025) through Dynadot LLC. The domain resolves to 142.250.185.164, an address owned by Google LLC (AS15169) located in the United States. Despite hosting on Google’s infrastructure, the site lacks an SSL certificate and currently returns an offline HTTP status. The page title observed before takedown was "Google", matching the declared brand target. Google Safe Browsing classifies the URL as a social‑engineering threat, and the activity is cataloged as brand impersonation. VirusTotal records indicate that 9 of 95 scanned scanners flagged the domain, reinforcing the malicious assessment.

The domain appears on a single public blocklist and has been added to PhishDestroy’s deny list. Gridinsoft assigns a trust score of 0/100, reflecting extreme suspicion. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. The combination of brand‑targeted page title, social‑engineering label, multiple vendor detections, and a zero‑trust score suggests an intent to deceive users into believing the site is a legitimate Google service.

Because the site is already offline, immediate remediation consists of ensuring that internal DNS resolvers and proxy appliances block the domain and its associated IP address. Threat‑intel feeds should be updated to include the domain, its registrar, and the observed IP range. Continuous monitoring for similar sub‑domains registered under the same registrar or using the same Cloudflare nameservers is recommended, as attackers often recycle infrastructure. At present, no additional artifacts such as malware payloads or credential‑harvesting pages have been released, so further investigation is limited to the infrastructure indicators described.