plume[.]beefy-hub[.]sbs

The domain plume.beefy-hub.sbs was created on October 25, 2025 and registered through Dynadot LLC. DNS resolution points to the IPv4 address 172.217.18.4, an address owned by Google LLC (AS15169) and located in the United States. No SSL certificate was observed during the scan, indicating that the site was served over plain HTTP. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The page title returned by the server is "Google," matching the declared brand target of Google and aligning with the classified scam type of brand impersonation.

VirusTotal analysis shows that eight of ninety‑five security vendors flagged the domain, providing modest but notable detection confidence. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the perception of malicious intent. The domain has been added to one security blocklist and is actively blocked by PhishDestroy.

Current operational status is offline, and no further content was captured, leaving the exact malicious payload or credential‑capture mechanism unverified. Defenders should add plume.beefy-hub.sbs to network block lists, monitor for any resurgence of the domain or similar Cloudflare‑based name server configurations, and consider the associated IP address as suspicious when observed in traffic destined for Google‑related services. Continued observation of VirusTotal and other multi‑vendor scans is advised to capture any changes in detection rates.