flx[.]beefyhub[.]lat

Analysis of flx.beefyhub.lat indicates that the domain is being used for brand impersonation targeting Google. The site was created on October 21, 2025 and is registered through Dynadoc LLC, a registrar known for low‑cost registrations. DNS resolution points to the IPv6 address 2a00:1450:4001:830::2004, which belongs to the AS15169 network operated by Google LLC and is geographically located in Germany. The domain is hosted on Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common choice for fast‑flux and abuse mitigation. No SSL certificate is presented, and the page title returned by the HTTP response is the plain string "Google", confirming the advertised brand target.

Threat intelligence feeds have added the domain to a single blocklist, and it is currently blocked by the PhishDestroy service. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, providing additional confirmation of malicious intent. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low reputation. The domain is presently offline, which limits immediate exposure but does not eliminate the risk of re‑activation.

Defenders should continue to monitor the IPv6 address and associated Cloudflare name servers for any future activity, enforce URL filtering for the exact host, and consider adding the domain to internal blocklists. Because the site lacks TLS, any future re‑hosting would be easily detectable through certificate absence. Attribution beyond the observed infrastructure is uncertain; no additional payload, phishing kit, or victim data has been disclosed. Continuous observation of the registrar and hosting environment is recommended to detect potential re‑use of the same registration details for other impersonation campaigns.