cow[.]beefy-hub[.]lat

This domain, cow.beefy-hub.lat, is flagged as a high-risk brand impersonation threat targeting Google, as indicated by its page title 'Google' and confirmed by multiple security sources. Registered on October 25, 2025, through Dynadot LLC, the domain was operational until recently taken offline. Infrastructure analysis reveals it resolved to the IP address 142.250.186.68, geolocated in Germany and associated with AS15169 (Google LLC), though this IP alignment does not confirm legitimacy and may reflect misdirection or abused hosting. No SSL certificate was detected, a common red flag for phishing infrastructure.

Detection data shows the domain appeared on one security blocklist (PhishDestroy) and was classified as social engineering by Google Safe Browsing. Twelve of 95 security vendors on VirusTotal flagged the domain, though the absence of additional context limits interpretation of these detections. The domain's trust score from Gridinsoft is 0/100, reinforcing its malicious classification. Nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) suggest Cloudflare provisioning, a frequent choice for both legitimate and malicious domains due to its privacy and performance features.

While the domain is currently offline, defenders should treat it as a confirmed phishing artifact. Historical DNS and WHOIS records should be preserved for forensic analysis, and any residual resolution attempts should be blocked. The lack of SSL, low trust scores, and blocklist presence provide sufficient evidence to classify this as a deliberate Google impersonation attempt, though the exact payload or user interaction flow remains unanalysed. No evidence links this domain to known phishing kits or broader campaigns, and further investigation would require access to archived content or logs.