wlfi[.]beefyhubs[.]sbs

Analysis of wlfi.beefyhubs.sbs indicates a brand impersonation campaign targeting Google, active since its registration on October 21, 2025. The domain, hosted on Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com), resolved to 142.250.185.132, an IP address geolocated to the US under AS15169 (Google LLC). This alignment with Google's infrastructure is anomalous for a phishing domain and may represent an attempt to evade detection through IP reputation. The site operated without an SSL certificate, a deviation from legitimate Google services, which universally enforce HTTPS. The page title 'Google' directly matches the impersonated brand, reinforcing the intent to deceive users into believing the site is authentic.

Detection data from July 23, 2026, shows the domain flagged by 13 of 95 security vendors on VirusTotal and listed on one security blocklist, with PhishDestroy explicitly blocking it. Gridinsoft assigned a trust score of 0/100, further corroborating malicious classification. The domain was registered through Dynadot LLC, a registrar frequently used for abusive domains due to its accessibility and privacy features. As of the report date, the domain is offline, though prior infrastructure (nameservers, IP) may remain indicative of similar campaigns.

Defenders should treat this domain as confirmed malicious, particularly for Google credential harvesting. The absence of SSL and the use of Cloudflare nameservers are red flags for similar domains. Monitoring for re-registration or reuse of the IP (142.250.185.132) under different domains is recommended, as the infrastructure may persist despite takedown. No evidence links this domain to a specific phishing kit or broader campaign, but the combination of brand impersonation, detection vendor flags, and anomalous hosting warrants blocking at the network and endpoint levels.