mon[.]beefy-hub[.]sbs

Analysis of the domain mon.beefy-hub.sbs indicates a recent brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on October 25, 2025 and resolves to the IP address 142.251.35.164, which belongs to AS15169 Google LLC and is geolocated in the United States. DNS resolution is served by the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed for the site, and the current HTTP status reports the service as offline, suggesting that the payload may have been taken down or is otherwise unavailable.

VirusTotal scans have recorded 15 positive detections out of 95 security vendors, reflecting a moderate level of consensus among analysis engines that the domain is malicious. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. The page title returned from the host is "Google," matching the declared brand target and confirming the intent to masquerade as a legitimate Google service.

While the available data confirm the presence of brand‑impersonation infrastructure, details such as the exact phishing kit, specific URL paths, and user‑facing content remain unknown because the site is offline and no further content was captured. Defenders should continue to monitor DNS queries for the associated Cloudflare nameservers, enforce blocklist entries for the domain and its resolving IP, and consider adding the domain to internal URL filtering rules. Threat‑intelligence platforms should update their records with the registration date, registrar, and detection count to improve attribution and future detection of related campaigns.