plume[.]beefy-hub[.]lat

plume.beefy-hub.lat was registered through Dynadot LLC on 25 October 2025. The domain resolves to 142.250.181.228, an address owned by AS15169 Google LLC located in the United States. Despite the legitimate hosting prefix, the site is listed on a single security blocklist and has a Gridinsoft trust score of 0/100, indicating a high likelihood of malicious use. The page title returned by HTTP requests is “Google”, matching the declared brand target of Google and confirming the classification as a brand‑impersonation scam. No TLS certificate is presented, so connections are unencrypted.

The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare. PhishDestroy has already blocked the domain, and VirusTotal reports that 15 of 95 scanned security vendors flagged the host, reinforcing the suspicion. The current status is offline, suggesting the operators have taken the site down, but the infrastructure components remain observable. Analysis indicates that the domain was likely used to lure victims into believing they were interacting with a legitimate Google service, leveraging the identical page title and the Google‑owned IP range to increase credibility. The lack of SSL, low trust score, and multiple vendor detections point to a deliberately deceptive campaign rather than an accidental misconfiguration.

Uncertainty remains regarding the exact phishing kit, the content served before takedown, and whether any credentials were harvested. Defenders should continue to monitor the domain and its IP address for re‑activation, add the domain to internal blocklists, and enforce TLS inspection to detect any future attempts to serve malicious content from the same infrastructure. Network‑level controls that restrict outbound connections to the identified IP or to Cloudflare nameservers associated with this domain can further reduce exposure.