wlfi[.]beefyhubs[.]cfd

The domain wlfi.beefyhubs.cfd was registered through Dynadot LLC on 21 Oct 2025 and resolves to 172.253.62.99, an address owned by Google LLC (AS15169) located in the United States. No TLS certificate is presented for the host, indicating that the site was served over plain HTTP. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both belonging to Cloudflare's DNS service. The single page that responded returned the HTML title “Google”, which does not correspond to the advertised target brand, yet the domain is classified as a Facebook brand‑impersonation campaign.

VirusTotal analysis recorded detections from ten of ninety‑five scanning engines, and the Gridinsoft trust score is 0 / 100, reflecting a high likelihood of malicious intent. PhishDestroy has placed the domain on its blocklist, and it appears on one additional public security blocklist, reinforcing its reputation as a threat vector. The current operational status is offline, suggesting that the infrastructure has been taken down or is no longer serving content. Because the domain leveraged Google‑owned infrastructure, it could inherit a degree of implicit trust from network‑level controls that whitelist Google IP ranges.

Defenders should proactively add wlfi.beefyhubs.cfd to URL filtering and DNS sink‑hole policies, monitor for any re‑registration attempts, and consider extending blocklists that reference the associated Cloudflare name servers. Continuous telemetry on similar Cloudflare‑hosted, low‑trust‑score domains targeting Facebook should be collected to improve early detection. Until further evidence emerges, the domain should be treated as a confirmed malicious actor aligned with brand‑impersonation tactics.