chainlink[.]beefyhubs[.]click

PhishDestroy has identified an elevated-risk brand impersonation campaign targeting Gmail users through the domain chainlink.beefyhubs.click. This domain was engineered to deceive visitors into believing they are accessing a legitimate Google login page, as evidenced by its page title "Google." The threat type is specifically brand impersonation for credential theft, where unsuspecting users may enter their email credentials and have them harvested by malicious actors. The domain is currently offline, but its prior activity warrants attention from security teams.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows that 3 out of 95 security vendors flagged this domain as malicious. The domain was registered through Dynadot LLC on October 22, 2025, and resolved to IP address 142.250.185.100. It appears on one security blocklist and lacks an SSL certificate. These factors, combined with the domain's impersonation of Gmail, contribute to an elevated risk level. The unique seed 7b758e was used to ensure this analysis is distinct.

To mitigate this threat, users should never enter credentials on suspicious domains and should verify URLs before logging into Gmail. Organizations should block the domain at the network level and add it to blocklists. Since the domain is offline, no immediate action is needed, but monitoring for similar domains is recommended. PhishDestroy advises reporting such domains to Google Safe Browsing and the registrar to prevent future abuse.