ip[.]beefyhub[.]sbs

This domain, ip.beefyhub.sbs, was observed targeting Google users through a brand‑impersonation campaign. The site was registered on 19 October 2025 via Dynadot LLC and is currently taken offline. DNS resolution points to the IP address 216.58.206.36, which belongs to AS15169 Google LLC and is geolocated to Germany. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL certificate, leaving the connection unencrypted. The HTML title returned by the server is “Google”, matching the declared brand target.

Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. The domain appears on a single security blocklist and has been flagged by the PhishDestroy sinkhole. VirusTotal analysis shows that three of ninety‑five scanners identified malicious behavior, indicating limited but non‑trivial detection. No additional public threat‑intel feeds, such as OTX or Safe Browsing, were referenced in the available data.

The available evidence confirms that the infrastructure was deliberately crafted to mimic Google’s branding, yet the lack of TLS and the modest detection rate suggest a relatively unsophisticated operation that may have been short‑lived. Uncertainty remains regarding the exact phishing kit used, the presence of any payload, and whether the domain was ever served over HTTPS before being taken down. Defenders should block the domain and its associated IP at perimeter firewalls, update URL filtering lists, and monitor for any resurgence of similarly structured sub‑domains under the same registrar or nameserver pair. Continuous re‑scanning of the domain on multi‑engine platforms is advised to capture any later changes in detection status.