aethir[.]beefy-hub[.]sbs

This domain, aethir.beefy-hub.sbs, was registered through Dynadot LLC and created on 25 October 2025. DNS resolution points to 142.250.186.164, an address owned by AS15169 Google LLC located in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented, meaning the site is served over plain HTTP only. Google Safe Browsing has classified the domain as a social‑engineering threat, and VirusTotal reports that 15 of 95 scanning engines flag it as malicious.

The site appears on a single external blocklist and has been taken down by the PhishDestroy takedown service. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The page title returned by the server is “Google”, matching the declared brand target and confirming a brand‑impersonation campaign. Evidence shows the infrastructure is deliberately aligned with Google’s IP space, likely to increase credibility with unsuspecting victims. The lack of an SSL certificate may be an oversight or a tactic to avoid certificate‑issuance scrutiny.

At present the domain is offline, but the registration and DNS configuration remain observable. Defenders should continue to block the domain at network perimeter and proxy layers, monitor for any re‑registration attempts, and add the IP address 142.250.186.164 to threat‑intel feeds. Because the domain leverages Cloudflare name servers, any future activity may originate from the same resolver set, so alerts on similar sub‑domain patterns are advisable. Ongoing surveillance of Dynadot registrations for similarly structured names is also recommended.