zircuit[.]beefy-hub[.]sbs

The domain zircuit.beefy-hub.sbs was registered through Dynadot LLC on 25 October 2025 and is configured to resolve to the IP address 172.253.62.147, which belongs to AS15169 Google LLC in the United States. The site presented a page title of “Google”, matching the declared brand target, and was classified as a brand‑impersonation campaign. No TLS certificate was observed, indicating that the service was delivered over plain HTTP. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed, suggesting the use of a commercial DNS provider to hide infrastructure.

VirusTotal recorded nine positive detections out of ninety‑five scanned scanners, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The site has since been taken offline, but the underlying infrastructure and registration details remain observable. Defenders should treat the domain as malicious despite its current offline state.

Immediate actions include adding the domain and its resolved IP address to local deny‑list policies, ensuring that any outbound connections to 172.253.62.147 are blocked, and publishing an indicator‑of‑compromise (IOC) that references the registrar, creation date, and Cloudflare name servers. Continuous monitoring of new subdomains under the same registrar or similar naming patterns is advised, as the actors may reuse the same infrastructure for future impersonation attempts. Because the domain leveraged a legitimate cloud provider, threat‑intel feeds should be consulted for any related domains that share the same name‑server pair. Finally, security teams should verify that web filtering solutions are configured to flag the page title “Google” when presented without a valid TLS certificate, as this combination has proven indicative of this campaign.