w[.]beefy-hub[.]lol

The domain w.beefy-hub.lol was registered on October 25, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to the IP address 142.251.167.103, which is owned by AS15169 Google LLC and resolves in the United States. The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) but presents no SSL certificate, indicating that HTTPS was not configured before the takedown. The only visible HTML element reported is a page title of "Google," and the intelligence explicitly marks the domain as impersonating the Google brand.

VirusTotal scans have recorded 12 detections out of 95 security vendors, demonstrating that a notable minority of scanners identify malicious characteristics. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, confirming that at least one external threat‑intelligence source has taken remedial action. No additional evidence such as Safe Browsing status, OTX references, or kit attribution is available. While the hosting IP belongs to Google’s own infrastructure, the lack of TLS and the brand‑impersonation flag suggest the domain was likely leveraged to host a fraudulent page that mimics Google’s login or service pages.

Defenders should continue to monitor the domain’s DNS records for any re‑activation, enforce strict brand‑monitoring rules for newly created domains that resolve to Google‑owned IP space, and ensure that any residual URLs are added to internal blocklists. Organizations using Google services should also verify that users are not redirected to this domain and consider publishing user‑education notices about the offline threat. The current evidence is limited to registration data, DNS configuration, detection counts, and blocklist presence; no content‑level analysis is available, so further investigation would be required should the domain become active again.