mon[.]beefyhubs[.]sbs

Analysis of the domain mon.beefyhubs.sbs, observed on July 23 2026, indicates that it is being used for brand impersonation of Google. The domain was registered through Dynadot LLC on 21 October 2025 and is delegated to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.184.196, which belongs to AS15169 owned by Google LLC and is located in the United States. The site presents a page title of “Google”, matching the targeted brand, but no TLS certificate is deployed, leaving the HTTP endpoint unsecured.

VirusTotal has recorded detections from 13 of 95 scanned security vendors, confirming that multiple scanners flag the host as malicious. The domain is listed on one public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing vector. Current monitoring shows the host is offline, which may be a temporary takedown or a shift to a different infrastructure.

The evidence does not reveal whether additional infrastructure, such as content delivery networks or secondary IPs, is being used, nor does it disclose the specific phishing kit or page content beyond the title. Defenders should add the domain to internal blocklists, monitor the associated IP range for any resurgence, and enforce strict verification of any Google‑related communications. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in detection status, and any future DNS changes should be flagged for rapid response.