sca[.]beefy-hub[.]lol

Analysis of sca.beefy-hub.lol indicates a brand impersonation campaign targeting Google users, operational from October 25, 2025, until taken offline prior to July 23, 2026. The domain was registered through Dynadot LLC and resolved to IP address 142.250.185.100, which belongs to Google LLC (AS15169) in the United States, though this does not confirm hosting by the legitimate brand. The site's page title was identified as 'Google,' aligning with the impersonation target. No SSL certificate was present, increasing the risk of credential interception during transmission. Security vendor detections at the time of assessment showed 14 of 95 engines flagging the domain on VirusTotal, while PhishDestroy had already implemented blocking measures.

The domain appeared on one additional security blocklist. Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) were in use, a common infrastructure choice for both legitimate and malicious domains. Gridinsoft assigned a trust score of 0/100, further supporting its classification as high-risk. Defenders should treat this domain as confirmed malicious for the period it was active.

While the site is currently offline, the infrastructure may be repurposed or reactivated. Network-level blocking of sca.beefy-hub.lol and monitoring for related subdomains or similar patterns under beefy-hub.lol is recommended. The absence of an SSL certificate and the use of a page title matching the impersonated brand provide clear indicators for detection rules. No evidence of a phishing kit or specific scam subtype (e.g., credential harvesting, account verification) was present in available data, so further forensic analysis would be required to determine exact attack methods.