morpho[.]beefy-hub[.]lol

Analysis of the domain morpho.beefy-hub.lol indicates it was actively used for brand impersonation targeting Facebook users. The domain, registered on October 25, 2025, through Dynadot LLC, resolved to the IP address 142.251.40.228, hosted on Google LLC infrastructure (AS15169) in the United States. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com were in use, though no SSL certificate was detected. The page title returned as 'Google,' which does not align with the declared brand target, suggesting either misconfiguration or an attempt to evade detection by presenting unexpected content.

As of July 23, 2026, the domain is offline, though it remains flagged by at least one security blocklist (PhishDestroy). VirusTotal records show 15 of 95 security vendors marked the domain as malicious, providing additional evidence of its use in phishing operations. The domain's creation date, infrastructure, and detection history collectively support its classification as a brand impersonation threat.

Defenders should treat this domain as compromised and maintain blocking rules to prevent potential re-emergence. Further investigation into associated infrastructure, such as shared hosting or nameserver patterns, may reveal additional linked threats. No evidence currently suggests the use of a specific phishing kit or broader campaign affiliation, and the exact content served by the site remains unanalyzed.