rls[.]beefyhub[.]club

Analysis of rls.beefyhub.club indicates that the domain was registered through Dynadot LLC on 21 October 2025 and is configured to use Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to the IP address 192.178.155.147, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate is presented; the site responded without HTTPS, confirming the absence of encryption. The only visible HTML element captured before the site was taken offline is the page title “Google”, matching the declared target brand.

The intelligence profile classifies the activity as a brand‑impersonation campaign aimed at Google, and the domain is listed on at least one public security blocklist. Two of ninety‑five VirusTotal scanners flagged the domain, while the Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent. PhishDestroy has already blocked the domain.

Because the site is currently offline, no further payload, redirect chain, or credential‑harvesting infrastructure can be observed, leaving the exact malicious behavior uncertain. Defenders should continue to block the IP 192.178.155.147 and the domain name, monitor the associated Cloudflare nameservers for re‑use, and add the domain to internal blocklists. Additional surveillance of the hosting ASN and any future DNS changes is recommended to detect potential re‑activation.