tia[.]beefy-hub[.]sbs

Analysis indicates that the domain tia.beefy-hub.sbs was registered through Dynadot LLC on October 25 2025 and is currently hosted on an IP address owned by Google (172.253.115.99, AS15169, United States). The domain resolves to that IP without presenting an SSL certificate, and the HTTP response returns a page whose title is simply “Google”. Threat intelligence classifies the site as a brand‑impersonation campaign targeting Facebook, although the visible page title does not reference the victim brand. The infrastructure uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for fast‑flux or abuse of legitimate CDN services.

The domain appears on a single security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, indicating extreme distrust. VirusTotal has recorded nine detections out of ninety‑five scanned engines, reinforcing the malicious assessment. No TLS certificate is present, which may hinder secure browsing warnings but also suggests a hastily deployed site.

Because the site is currently taken offline, active exploitation cannot be confirmed, yet the combination of brand impersonation, low trust score, blocklist listing, and multiple vendor detections warrants a high confidence that the domain was used for phishing or credential‑stealing activities. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP and Cloudflare name servers, and ensure that endpoint protection solutions flag any attempted connections. Continued observation of the IP range and the registrar’s newly created domains is advised to detect possible re‑use of the same infrastructure.