yield[.]beefy-hub[.]lol

Analysis of yield.beefy-hub.lol indicates a confirmed brand‑impersonation campaign targeting Google users. The domain was registered on October 25, 2025 through Dynadot LLC and currently resolves to IP address 142.251.140.164, which belongs to AS15169 Google LLC and is located in the United States. The use of Google‑owned infrastructure, combined with a page title of "Google," suggests an attempt to lend legitimacy to the site. No SSL certificate was observed, meaning the site served traffic over plain HTTP, which is atypical for a domain attempting to mimic a major brand.

Reputation data shows that 15 of 95 security vendors on VirusTotal flagged the domain as malicious, and Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. The domain appears on at least one public blocklist, with PhishDestroy actively blocking it. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS service. The site’s current status is offline, limiting immediate observation of its content or payload.

However, the combination of brand impersonation labeling, vendor detections, low trust score, and blocklist presence provides sufficient confidence to treat the domain as hostile. Defenders should add yield.beefy-hub.lol to URL filtering and DNS blocklists, monitor for any resurgence of activity, and educate end users that any unsolicited communications referencing this domain are fraudulent. Continuous threat‑intel sharing with upstream providers is recommended to ensure rapid propagation of this indicator across security controls.