polkadot[.]beefyapp[.]sbs

polkadot.beefyapp.sbs was registered through Dynadot LLC on 2025-10-02. The domain resolves to IP 142.250.184.196, which is owned by AS15169 Google LLC and located in the United States. Despite the IP belonging to Google’s infrastructure, the domain does not present a valid TLS certificate, indicating that any traffic would be unencrypted. The site’s HTML title is simply “Google”, matching the declared target brand and supporting the classification as a brand‑impersonation campaign. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy feed.

VirusTotal reports that five of ninety‑five scanning engines have flagged the domain, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, which aligns with the other indicators. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The current online status is reported as offline, suggesting that the payload may have been taken down or is intermittently reachable.

No SSL certificate is observed, and no additional content analysis is available, leaving the exact landing page and any credential‑harvesting mechanisms unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the host IP in new domain registrations, and update endpoint detection signatures to include the observed VirusTotal detections. Because the domain mimics Google, security awareness training should remind users to verify HTTPS connections and to disregard unsolicited requests that reference Google without a proper certificate. Ongoing surveillance of the associated IP range and Cloudflare nameservers is advised to catch possible reuse in future impersonation attempts.