wct[.]beefyhub[.]icu

The domain wct.beefyhub.icu was a phishing site engaged in brand impersonation, specifically targeting Google. It posed an elevated risk by mimicking the Google login interface to harvest user credentials, though no crypto drainer kit was detected. As of the latest verification, wct.beefyhub.icu has been taken offline.

Technical analysis shows that wct.beefyhub.icu was flagged by 3 of 95 VirusTotal security vendors, including ChainPatrol, Forcepoint ThreatSeeker, and SOCRadar. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through Dynadot LLC on October 19, 2025, and resolved to the IP address 142.250.184.228, hosted on Google LLC infrastructure in the US. No SSL certificate was present, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, with a Gridinsoft trust score of 0/100.

Users who interacted with wct.beefyhub.icu should immediately change their Google account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s Safe Browsing team via their reporting tool and to the registrar, Dynadot LLC, to aid in further takedown efforts. Additionally, victims may submit the domain to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to help protect others.