sophon[.]beefyhubs[.]monster

This report details a domain involved in an impersonation scam. The site, with a page title of "Google," masquerades as the brand "gmail" to deceive users into believing they are accessing a legitimate Google service. The primary threat is impersonation, where the site likely attempts to capture credentials or other sensitive information from users who are misled by its fraudulent appearance.

Technical evidence confirms the malicious nature of this domain. VirusTotal analysis shows 7 out of 95 security vendors flagged the site as malicious. The domain is registered with Dynadot LLC, hosted on IP address 216.58.206.36, which is located in Germany and belongs to AS15169 Google LLC. The domain was created on 2025-10-26 and has no SSL certificate, which is typical for fraudulent sites. The domain is currently flagged by multiple security entities including ChainPatrol, alphaMountain.ai, CRDF, CyRadar, and Lionic, and appears on one blocklist.

The domain is currently offline or down. Its risk level is assessed as high, supported by a GridinSoft trust score of 0 out of 100 and a DOM risk score of 25. The combination of impersonating a trusted brand, low trust score, and multiple vendor detections indicates a significant threat, though its current offline status mitigates immediate risk to users.