nexusmutual[.]beefyhubs[.]click

The domain nexusmutual.beefyhubs.click is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. As of the latest verification, nexusmutual.beefyhubs.click has been taken offline.

Technical indicators confirm the elevated risk level. The domain was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. Registered through Dynadot LLC on October 22, 2025, nexusmutual.beefyhubs.click resolves to the IP address 142.251.40.164, hosted on Google LLC infrastructure in the US (AS15169). No SSL certificate was issued for the domain, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100.

Users who interacted with nexusmutual.beefyhubs.click should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to mitigate further risk. Monitor accounts for unauthorized activity, such as login attempts or transactions. Report the phishing domain to Google’s Safe Browsing team via their reporting tool and to the registrar, Dynadot LLC, to support takedown efforts. Additionally, victims may file a complaint with the FBI’s Internet Crime Complaint Center (IC3) or their local cybercrime unit.