aethir[.]beefyhubs[.]cfd

Analysis of the domain aethir.beefyhubs.cfd, observed as offline on the report date of July 25 2026, shows that it was registered through Dynadot LLC and created on October 21 2025. The site presents a page title of "Google" and is explicitly listed as impersonating Google, classifying it as a brand‑impersonation scam. No SSL certificate is associated with the domain, indicating that any traffic would occur over plain HTTP if the site were active. DNS resolution points to the IP address 142.250.186.68, which belongs to AS15169 Google LLC and is geolocated in Germany, suggesting the attacker is leveraging legitimate Google infrastructure to host the malicious payload, a tactic that can increase the likelihood of bypassing network‑level filters.

The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), providing resilience against takedown attempts. Infrastructure reputation is extremely poor, with a Gridinsoft trust score of 0 out of 100 and inclusion on a single security blocklist; the domain is also flagged by PhishDestroy. VirusTotal analysis records seven detections out of ninety‑five scanned vendors, reinforcing the suspicion of malicious intent.

Because the site is currently offline, no HTTP status code, response headers, or content snapshots are available, leaving the exact nature of the impersonation page (e.g., credential‑capture form) unverified. Defenders should proactively block the domain at DNS and proxy layers, add the IP address 142.250.186.68 to network‑wide deny lists, and monitor for any future re‑registration or re‑activation. Reporting the abuse to Google’s security team and to the registrar Dynadot is recommended to aid takedown efforts and to prevent further exploitation of the brand.