fuel[.]beefyhubs[.]lat

The domain fuel.beefyhubs.lat is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page but is designed to deceive users into disclosing sensitive information. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, though prior exposure may still pose threats to affected users.

Technical indicators confirm fuel.beefyhubs.lat as a malicious domain. It was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, and appears on 1 security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 21, 2025, and resolves to the IP address 142.250.185.100, hosted on Google LLC's infrastructure (AS15169). No SSL certificate was issued, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with fuel.beefyhubs.lat should take immediate safety steps. If login credentials were entered, change passwords for the affected account and any reused credentials, then enable two-factor authentication (2FA). Monitor accounts for unauthorized activity and report suspected fraud to the impersonated brand (Google) and relevant financial institutions. Victims may also report the domain to their local cybercrime unit or platforms like the FBI’s IC3 or the FTC. Avoid revisiting the site, and consider using browser-based security tools to block known phishing domains.