sophon[.]beefy-hub[.]sbs

Analysis as of July 23 2026 indicates that the domain sophon.beefy-hub.sbs is actively being leveraged for a Google brand impersonation campaign. The site presented a page title of “Google”, matching the declared target brand. The domain was registered through Dynadot LLC on October 25 2025 and is served from the IP address 142.251.40.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting infrastructure uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed, meaning the site operated over plain HTTP. VirusTotal scans returned 15 detections out of 95 security vendors, confirming that a substantial portion of the scanning community classifies the domain as malicious.

PhishDestroy has already added the domain to its blocklist, and it appears on one additional security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, further indicating a high confidence of malicious intent. The domain is currently offline, which may be the result of takedown actions or temporary hosting changes. Uncertainties remain regarding the exact content served before the takedown, as no screenshot or HTML capture is available in the current intelligence set. The lack of an SSL certificate prevents verification of certificate‑based fingerprinting, and the short registration age limits the ability to assess long‑term infrastructure patterns.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include sophon.beefy-hub.sbs, and monitor for any re‑registration attempts. Because the IP address belongs to Google’s own range, reliance on IP reputation alone could produce false positives; therefore, correlation with domain‑level indicators such as the observed page title, the VirusTotal detection count, and the Gridinsoft score is recommended.