morpho[.]beefyhubs[.]bond

On 22 July 2026, analysis identified the domain morpho.beefyhubs.bond as an elevated‑risk brand‑impersonation infrastructure targeting Google. The domain was registered through Dynadot LLC on 26 October 2025 and utilizes the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.185.196, which belongs to AS15169 Google LLC and is located in the United States. The resolved IP is owned by Google, yet the domain lacks an SSL/TLS certificate, indicating that any HTTP service would be delivered over unencrypted connections.

A page title retrieved before the site was taken offline read “Google”, matching the declared brand target. The site was intercepted by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that it was recognized as malicious by at least two independent mitigation sources. VirusTotal scans reported that four of ninety‑five security vendors flagged the domain as malicious, providing further corroboration of its threat status. The current operational status is offline, preventing live interaction, but historical indicators suggest a typical phishing workflow that redirects victims to a domain that mimics a trusted brand name.

Defenders should continue to block the domain at DNS and network layers, monitor the associated IP address and Cloudflare nameservers for future re‑use, and add the domain to internal threat intel feeds. Additional investigation of the registration details and any related sub‑domains is recommended to uncover possible campaign infrastructure. Continuous observation of threat‑intel platforms for re‑registration or new activity related to morpho.beefyhubs.bond is advised.