klima[.]beefyhubs[.]bond

The domain klima.beefyhubs.bond was observed with a page title of “Google”, indicating an explicit attempt to impersonate the Google brand. Registration records show the domain was created on October 26 2025 through Dynadot LLC, and its authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated. DNS resolution points to IP address 172.253.62.105, which belongs to AS15169 owned by Google LLC and is geolocated in the United States.

Despite the IP belonging to Google’s own network, the domain lacks an SSL certificate, and the service has been taken offline at the time of reporting. Threat intelligence platforms have flagged the domain; PhishDestroy lists it as blocked, and VirusTotal reports that six of ninety‑five scanned security vendors flagged the domain as malicious. It appears on a single external blocklist.

The combination of brand‑targeted page title, recent registration, Cloudflare nameservers, and detection by multiple vendors suggests a deliberate brand‑impersonation campaign aimed at harvesting credentials or delivering malicious payloads. Defenders should continue to block the domain at perimeter controls, monitor for any resurgence, and consider adding the IP address to reputation lists pending further analysis. Additional investigation is needed to confirm the exact payload or credential‑harvesting mechanism, as current evidence is limited to DNS and detection metadata.