plume[.]beefyhubs[.]sbs

The domain plume.beefyhubs.sbs was registered on October 21, 2025 through Dynadot LLC and is currently listed as offline. DNS resolution points to the IP address 142.250.186.68, which is owned by AS15169 Google LLC and geolocated to Germany. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed for the host, meaning HTTPS connections would be unavailable or would fall back to an insecure HTTP endpoint. The page title returned by the server is "Google," matching the declared brand target and confirming the claim that the site is intended to impersonate Google as part of a brand‑impersonation campaign.

Security‑vendor analysis on VirusTotal shows that 14 of 95 scanners flagged the domain, suggesting malicious characteristics despite the relatively low detection rate. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, indicating that at least one anti‑phishing platform has taken action against it. Evidence points to a classic brand‑impersonation infrastructure: a recent registration, use of reputable DNS hosting, and resolution to an IP range owned by the targeted brand’s legitimate provider, likely to lend credibility.

However, the absence of an SSL certificate and the offline status limit the ability to observe the exact payload or any credential‑harvesting pages. The lack of additional contextual data such as Safe Browsing or OTX entries leaves open the question of whether the domain was ever actively serving phishing content before takedown. Defenders should add plume.beefyhubs.sbs to URL filtering and DNS blocklists, monitor for any re‑registration attempts, and consider extending coverage to the associated IP range (142.250.186.