threshold[.]beefyhubs[.]club

Analysis of threshold.beefyhubs.club shows a newly registered domain (creation date 22 Oct 2025) that was used to impersonate Google. The page title returned by the server is “Google”, matching the declared brand target. The domain is registered through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP 142.250.185.100, an address owned by AS15169 Google LLC located in the United States.

No TLS certificate is presented, implying that the site was served over plain HTTP. Gridinsoft assigns a trust score of 0 / 100, indicating extreme risk. Five of ninety‑five VirusTotal scanners flagged the host, and the domain appears on a single external blocklist, where it has already been taken down by PhishDestroy. The site is currently offline, limiting further live analysis.

The available evidence confirms the presence of a brand‑impersonation campaign targeting Google users, but the exact payload, credential‑capture mechanisms, and distribution vectors remain unknown because the site is not reachable. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for any traffic to the associated IP address. Given the low trust score and the detection history, the domain should be added to internal blocklists and flagged in security information and event management (SIEM) systems. Ongoing threat‑intel feeds should be checked for related indicators of compromise, especially any future registrations that reuse the same Cloudflare name servers or resolve to the same Google‑owned IP range.