folks[.]beefyhubs[.]click

The domain folks.beefyhubs.click was registered on 22 October 2025 through Dynadot LLC and is currently listed as offline. DNS resolution points to the IPv4 address 216.58.206.36, which is announced by AS15169 and geolocated to Germany, a range owned by Google LLC. The presence of a Google‑owned IP suggests the domain is leveraging a legitimate hosting block, but the domain itself is not associated with any Google‑controlled service. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating Cloudflare is used for DNS resolution. No TLS certificate was observed for the domain, meaning HTTPS connections would be unavailable or would fall back to plain HTTP.

The page title returned by the server is "Google", matching the declared brand target and confirming the classification as a brand‑impersonation campaign. Gridinsoft’s trust scoring system rates the site at 0 out of 100, and the domain appears on a single security blocklist, PhishDestroy, which has already flagged it. VirusTotal analysis shows four of ninety‑five scanners identified the domain as malicious, reinforcing the suspicion despite the low detection count. The limited detection footprint, lack of SSL, and zero trust score collectively indicate a low‑quality impersonation effort that has already been taken offline.

Uncertainty remains regarding any additional payloads or redirects that may have been hosted before takedown, as no further content analysis is available. Defenders should continue to block the domain at network perimeter, monitor for any DNS changes that could reactivate the host, and add the associated IP address to threat‑intel feeds. Ongoing observation of Cloudflare name‑server activity and periodic re‑scans on VirusTotal are recommended to catch any future re‑use of the infrastructure.