metis[.]beefyhub[.]lol

The domain metis.beefyhub.lol was registered on October 21, 2025 through Dynadot LLC and is currently taken offline. Infrastructure analysis shows that the domain resolves to IP address 142.250.176.196, which belongs to AS15169 Google LLC and is geolocated in the United States. No SSL/TLS certificate is presented for the domain, indicating that any HTTPS connections would be unencrypted or would trigger certificate errors. The domain is delegated to the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common configuration for malicious actors that seek to leverage Cloudflare’s CDN and protection services.

The page title returned from the site is "Google," matching the reported brand impersonation target. VirusTotal scans have flagged the domain in 2 of 95 security vendor checks, providing modest but concrete detection evidence. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being monitored as a phishing or brand‑impersonation resource. While the offline status limits immediate observation of content, the combination of a Google‑related page title, lack of TLS protection, use of reputable Cloudflare infrastructure, and detection by multiple vendors suggests intentional brand abuse.

Defenders should continue to monitor DNS queries for this domain, enforce blocklist updates that include it, and ensure that any residual traffic is redirected to safe browsing warnings. Threat intelligence feeds should be updated to reflect the impersonation of Google and the association with the IP owned by Google, which may be used to lend credibility to the malicious site. Given the limited detection count, further analysis of any cached page snapshots or forensic artifacts would be advisable to confirm the exact phishing vector employed.