bluefin[.]beefyhubs[.]click

Analysis of the domain bluefin.beefyhubs.click indicates a confirmed brand impersonation campaign targeting Google, as documented in threat intelligence records dated July 25, 2026. The domain was registered through Dynadot LLC on October 22, 2025, and is currently offline. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a configuration commonly observed in phishing operations to obscure hosting origins and evade takedowns. The domain resolved to IP address 142.250.185.100, geolocated to the United States under AS15169 (Google LLC), though this IP association does not confirm legitimacy and may reflect transient or misconfigured routing.

Security vendor assessments show limited but consistent detection: four of 95 engines on VirusTotal flagged the domain at the time of scanning, and it appears on one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious. The absence of an SSL certificate is notable, as legitimate Google services universally employ HTTPS. The page title 'Google' aligns with the brand impersonation objective, though the exact content and functionality of the site remain unanalyzed due to its offline status.

Defenders should treat this domain as a confirmed phishing threat. While currently inactive, the infrastructure may be reused or reactivated. Security teams are advised to block the domain at DNS and proxy layers, monitor for related subdomains under beefyhubs.click, and review logs for connections to 142.250.185.100 during the active period. Given the Cloudflare nameserver configuration, additional domains hosted on the same infrastructure may warrant investigation.