eth[.]beefy-hub[.]lol

Analysis of eth.beefy-hub.lol was performed on July 24, 2026. The domain was registered on October 25, 2025 through Dynadot LLC. It resolves to the IP address 142.250.185.164, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP. The HTTP response returned a page title of “Google”, matching the declared brand target.

Google Safe Browsing has flagged the domain for social engineering, and the threat is classified as brand impersonation of Google. The site has been added to at least one public blocklist and is currently blocked by the PhishDestroy service. Independent scanning on VirusTotal recorded detections by 10 of 95 security vendors, reinforcing the malicious assessment. Gridinsoft’s trust scoring system assigned a score of 0 out of 100, reflecting a high confidence of malicious intent. The domain’s status is listed as offline at the time of analysis.

Evidence gaps include the lack of a TLS certificate and the absence of publicly available screenshots or content analysis, preventing confirmation of the exact page layout or credential‑harvesting mechanisms. Additionally, the specific malware or credential‑stealing kit used has not been identified. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists with the observed IP and domain, and monitor for any re‑registration attempts. Organizations that employ Google services should educate users about the risk of unsolicited links that claim to originate from Google, emphasizing verification of HTTPS and correct domain spelling. Ongoing vigilance is recommended, as the infrastructure—particularly the Cloudflare name server configuration and the use of a Google‑owned IP address—could be leveraged for future campaigns.