astr[.]beefyhubs[.]click

The domain astr.beefyhubs.click was observed to resolve to 142.250.184.196, an address owned by AS15169 Google LLC in the United States. The domain was created on 22 October 2025 and is registered through Dynadot LLC. No TLS certificate was presented, indicating the site was served over plain HTTP or that HTTPS was not configured at the time of observation. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both belonging to Cloudflare's DNS service, which is a common choice for malicious operators seeking rapid deployment and DDoS mitigation. The page title returned from the HTTP response is “Google”, matching the declared brand target.

The infrastructure score from Gridinsoft is 0 out of 100, the lowest possible rating, and the domain appears on a single security blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline. VirusTotal analysis shows five of ninety‑five scanning engines flag the domain, providing additional corroboration of malicious intent.

Given the combination of a brand‑impersonating page title, a low trust score, the use of Cloudflare name servers, and the presence on a blocklist, the domain meets the criteria for a brand‑impersonation threat aimed at Google. Defenders should continue to block the domain at network perimeter devices, add the host to URL filtering lists, and monitor for any future re‑registration attempts. Because the site is currently offline and no SSL certificate was observed, further content analysis is not possible; analysts should treat any future resolution to the same host as a high‑confidence indicator of a Google‑impersonation campaign.