hbar[.]beefyhubs[.]lat

The domain hbar.beefyhubs.lat is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as an official Google page to deceive users into entering sensitive information, constituting a credential phishing threat. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk but not eliminating past exposure.

Technical indicators confirm hbar.beefyhubs.lat as malicious. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 21, 2025, and resolves to the IP address 142.250.186.164, hosted on Google LLC's infrastructure (AS15169). It appears on one security blocklist (PhishDestroy) and lacks an SSL certificate. The observed page title was 'Google', reinforcing the impersonation attempt. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who interacted with hbar.beefyhubs.lat should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s abuse form and to platforms like PhishTank or the Anti-Phishing Working Group to aid in takedown efforts. If financial or crypto services were accessed, review transaction histories for fraudulent activity.