sca[.]beefyhubs[.]sbs

The domain sca.beefyhubs.sbs has been identified as a brand impersonation threat specifically targeting Gmail. Analysis confirms the domain was designed to mimic the Google email service, as evidenced by its page title labeled "Google." Currently, the domain is offline, though it was previously operational and flagged by multiple security mechanisms. Infrastructure analysis reveals the domain was registered through Dynadot LLC on October 21, 2025, and resolved to the IP address 172.253.62.104, which is geolocated in the United States under AS15169 (Google LLC). Despite resolving to a Google-owned IP, the domain itself was flagged by 15 of 95 security vendors on VirusTotal, indicating its malicious nature. Additionally, it appears on one security blocklist and was previously blocked by internal detection systems. No SSL certificate was associated with the domain, further reducing its legitimacy. Given the domain's current offline status, immediate risk to users is mitigated. However, organizations should remain vigilant for similar impersonation attempts targeting Gmail or other major brands. Security teams are advised to monitor for domains registered through the same registrar (Dynadot LLC) or resolving to the same IP range, particularly those created in close temporal proximity to known malicious domains. Blocking the domain at the network level and alerting users to verify email service authenticity before entering credentials are recommended preventive measures.