aethir[.]beefyhubs[.]sbs

The domain aethir.beefyhubs.sbs was registered on October 21, 2025 through Dynadot LLC and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 172.253.62.103, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com indicate the use of Cloudflare DNS services, but no TLS certificate is presented, confirming the absence of HTTPS protection. The site’s HTML title tag reads "Google," while the advertised brand target is Facebook, classifying the activity as a brand impersonation campaign.

Reputation services assign extremely low trust scores: Scamadviser rates the domain at 1 out of 100 and Gridinsoft at 0 out of 100, reflecting a high likelihood of malicious intent. The domain has been flagged by 13 of 95 security engines on VirusTotal, and it appears on two external blocklists. Both PhishDestroy and ScamSniffer have already blocked the domain, and it is present on additional security blocklists.

Current evidence does not include a content capture; the site’s visual layout, login forms, or credential‑harvesting mechanisms have not been observed, leaving those aspects uncertain. Defenders should continue to block the domain at network perimeter devices, incorporate the IP address and hostnames into threat‑intel feeds, and monitor for any resurrection of the domain or the creation of look‑alike variants. Automated detections should be tuned to flag any HTTP traffic to aethir.beefyhubs.sbs, especially connections lacking TLS, and security teams should update URL filtering and sandbox rules to reflect the confirmed brand‑impersonation threat targeting Facebook users.