wlfi[.]beefy-hub[.]sbs

Analysis of the domain wlfi.beefy-hub.sbs indicates it was a brand-impersonation scam targeting Google users. The domain was registered on October 25, 2025, through Dynadot LLC and resolved to the IP address 142.251.40.164, which is assigned to Google LLC (AS15169) in the United States. Despite the IP association with Google, infrastructure analysis reveals the domain itself was hosted behind Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure the true origin of phishing sites. No SSL certificate was present, increasing the likelihood of interception or detection by security tools.

The page title was explicitly set to 'Google,' and the scam type was classified as brand impersonation, confirming the intent to deceive users into believing they were interacting with a legitimate Google service. At the time of assessment, the domain was flagged by 9 out of 95 security vendors on VirusTotal and appeared on one security blocklist, including PhishDestroy. The Gridinsoft trust score of 0/100 further supports the classification of this domain as malicious. As of July 23, 2026, the domain has been taken offline, though defenders should remain vigilant for re-registration or similar domains using the same infrastructure.

Organizations are advised to block the domain at the DNS or proxy level and monitor for any attempts to reuse the IP or nameserver patterns. The exact content of the phishing page is not yet analyzed, but the available indicators—page title, brand target, and scam classification—confirm its fraudulent nature. No evidence of credential harvesting kits or specific payloads was provided, so additional forensic analysis may be required if historical data is available.