eth[.]beefy-hub[.]sbs

Analysis indicates that the domain eth.beefy-hub.sbs was created on 25 October 2025 and is currently taken offline. The domain resolves to IP address 142.251.40.228, which belongs to AS15169 Google LLC located in the United States. No TLS certificate is presented for the host, and an HTTP request returns a page whose title is simply “Google”. Registration was performed through Dynadot LLC, and the authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare DNS infrastructure.

The Gridinsoft trust scoring system assigns a score of 0 out of 100, indicating a lack of trust. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Google Safe Browsing classifies the site as a social‑engineering threat, and VirusTotal reports that nine out of ninety‑five scanned security vendors have flagged the domain as malicious. The listed scam type is brand impersonation, specifically targeting Facebook, although the page title does not reference the brand.

The observable evidence therefore confirms the presence of a brand‑impersonation infrastructure that leverages a legitimate Google‑owned IP address to increase perceived legitimacy, while lacking HTTPS protection. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the site content beyond the title has not been captured. Defenders should continue to block the domain and its associated IP at perimeter and DNS layers, monitor for any future re‑activation, and consider adding the IP range of AS15169 to outbound filtering rules if not already covered. Ongoing threat‑intel feeds should be consulted for any new detections, and any internal users who may have received URLs referencing eth.beefy-hub.sbs should be advised to delete the messages and avoid interaction.