polkadot[.]beefy-hub[.]lol

Analysis of polkadot.beefy-hub.lol indicates a brand‑impersonation campaign targeting Google users. The domain was registered through Dynadot LLC on 25 October 2025 and is currently marked as taken offline. DNS resolution points to 142.250.181.228, an address owned by AS15169 Google LLC in the United States, suggesting the attacker deliberately leveraged legitimate Google infrastructure to increase credibility. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, a common choice for fast‑changing malicious sites. The site presented a page title of “Google” but offered no TLS certificate, leaving the connection unencrypted.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist. VirusTotal scans reported 14 positive detections out of 95 submitted samples, confirming that multiple AV engines flag the host as malicious. PhishDestroy has also listed the domain as blocked, reinforcing the assessment of a phishing‑type operation. Evidence points to a brand‑impersonation scam, yet the exact payload or credential‑harvesting mechanism remains unknown because the site is offline and no further content was captured.

Defenders should immediately block the domain and the associated IP address at perimeter and DNS filtering layers. Continuous monitoring of Cloudflare‑hosted subdomains that resolve to the same IP is advisable, as the infrastructure could be reused for future campaigns. Updating internal threat‑intel feeds with the registrar, creation date, and detection metrics will aid in correlating related activity. Organizations that rely on Google services should remain vigilant for unsolicited communications that reference the “Google” brand but originate from unrelated domains.