stellar[.]beefy-hub[.]lol

Analysis of stellar.beefy-hub.lol indicates that the domain was registered on 25 October 2025 via Dynadot LLC. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, pointing to a Cloudflare‑managed resolution that ultimately resolves to 142.251.40.164. The IP address is assigned to AS15169, owned by Google LLC, and geolocated to the United States. No TLS certificate is presented, and an HTTP request returns no content, consistent with the reported offline status. The page title returned by the server is “Google”, while the intelligence set classifies the site as a brand‑impersonation campaign targeting Facebook.

The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal reports that 14 of 95 security vendors have flagged the domain, indicating moderate detection across the ecosystem. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The elevated risk rating aligns with the combination of brand impersonation, low trust score, and multiple vendor detections.

Defenders should add the domain and its IP address to network deny lists, enforce DNS sink‑holing for the associated Cloudflare name servers, and monitor for any re‑registration attempts. Because the domain currently returns no SSL certificate and is offline, any future activation would likely present a similar infrastructure profile; continuous telemetry on the underlying IP and name server set is recommended. Until further evidence emerges, the domain should be treated as malicious and blocked at perimeter and endpoint layers.