arb[.]beefyhubs[.]lol

The domain arb.beefyhubs.lol was registered through Dynadot LLC on October 21, 2025. Its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to IP address 142.250.186.100, which is owned by Google LLC (AS15169) and geolocated in Germany. The resolved IP belongs to the legitimate Google infrastructure, yet the domain itself is not associated with an authorized Google property.

The HTTP response presents a page title of "Google" but no SSL certificate is served, leaving the site accessible only via unencrypted HTTP. Trust metrics from external assessors are extremely low: Scamadviser assigns a trust score of 1 / 100, while Gridinsoft rates it at 0 / 100, reflecting the high likelihood of malicious intent. Malware and reputation scanners on VirusTotal flagged the domain in 14 of 95 vendors, reinforcing the suspicion of abuse. The domain appears on the PhishDestroy blocklist, confirming that at least one security vendor has taken protective action.

Current operational status is offline, suggesting the site has been taken down or is temporarily inaccessible. However, the presence of the Google brand in the page title and the classification as a "Brand Impersonation" campaign indicate that the domain was intended to deceive users into believing it represented Google. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the observed indicator, and monitor the authoritative name servers for any re‑registration or changes in IP address that could reactivate the threat. Ongoing threat‑intel sharing with peer organizations is recommended to track potential reuse of the domain or related infrastructure.