rls[.]beefyhubs[.]monster

Analysis of rls.beefyhubs.monster confirms it as a brand-impersonation phishing domain targeting Google. The domain was registered on October 26, 2025, through Dynadot LLC and has since been taken offline. Infrastructure analysis reveals it resolved to IP 192.178.218.99, geolocated within AS15169 (Google LLC), though this does not imply hosting by Google itself. The site lacked an SSL certificate, increasing the likelihood of plaintext credential interception. Its page title was set to 'Google,' directly matching the targeted brand, and no additional page content or phishing kit details are currently available for analysis.

Detection data indicates the domain appeared on one security blocklist and was flagged by 7 of 95 security vendors on VirusTotal, confirming malicious classification. The domain was blocked by PhishDestroy prior to takedown. Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) were used for DNS resolution, a common pattern observed in phishing infrastructure due to the provider's accessibility and privacy features. Gridinsoft assigned a trust score of 0/100, further supporting its malicious designation.

Defenders should treat this domain as confirmed hostile. Any residual DNS queries or connections to 192.178.218.99 from internal networks should be investigated as potential compromise indicators. The domain's offline status does not preclude future reactivation; monitoring for re-registration or DNS changes is recommended. No evidence suggests this domain was part of a larger campaign, but correlation with other Google-themed phishing domains may reveal broader infrastructure patterns.