tia[.]beefy-hub[.]lol

Analysis on tia.beefy-hub.lol shows a newly registered domain created on October 25, 2025 and hosted under Dynadot LLC. The domain resolves to 142.251.40.164, an IP address owned by AS15169 Google LLC and located in the United States. Despite sharing the same IP block as legitimate Google services, the site does not present a valid TLS certificate, leaving the connection unencrypted. The page title returned by the server is simply “Google”, matching the declared brand target of Google and confirming a brand‑impersonation intent.

VirusTotal records indicate that 13 of 95 scanned security vendors flagged the domain, and the site appears on a single external blocklist, currently blocked by PhishDestroy. The hosting infrastructure uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for domains that rely on Cloudflare’s CDN or proxy services. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification.

The domain is presently offline, and the threat actor has taken it down, possibly to evade further analysis. Defenders should continue to block the domain and the associated IP address at perimeter firewalls and proxy devices, update URL filtering lists, and monitor for any re‑registration or emergence of similar sub‑domains that reference the same brand. Incident response teams should also consider the possibility of credential‑harvesting campaigns linked to this infrastructure, given the brand‑impersonation label, and apply typical phishing remediation steps such as user education, multi‑factor authentication enforcement, and rapid takedown requests to the registrar if the domain reappears.