cetus[.]beefyhubs[.]life

This domain cetus.beefyhubs.life was registered on 26 October 2025 through Dynadot LLC and is currently taken offline. The site resolves to the IPv6 address 2607:f8b0:4004:c07::68, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate was observed, indicating the site operated without HTTPS. The page title returned by the server is the literal string "Google", matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy lists it as blocked.

VirusTotal analysis shows that 13 out of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external blocklist. The combined evidence suggests a high‑risk impersonation attempt likely designed to lure victims into providing Google credentials or other sensitive data. Uncertainties remain regarding the exact phishing kit or payload used, as no SSL certificate or content snapshot is available.

The lack of a live host limits further behavioural analysis, and no additional intelligence such as malware hashes or phishing email samples has been published. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any resurgence of the same host or related sub‑domains. Incident response teams should also audit logs for any outbound connections to the IPv6 address and consider adding the IP to threat‑intel feeds. Ongoing surveillance of the registrar Dynadot’s newly created domains is recommended to catch future campaigns that may reuse similar naming patterns.