mole[.]beefy-hub[.]sbs

This domain, mole.beefy-hub.sbs, is flagged as a brand impersonation threat specifically targeting Google. Analysis of the infrastructure reveals a page titled 'Google,' designed to mimic legitimate Google services, likely for credential theft or other malicious activities. No crypto drainer kit signatures were detected, but the domain’s design and metadata align with credential harvesting campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered through Dynadot LLC on October 25, 2025, and resolves to the IP address 142.251.40.164, geolocated within AS15169 (Google LLC). Despite this IP association, the domain lacks an SSL certificate, a red flag for malicious activity. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and is not currently listed in Google Safe Browsing (GSB) at the time of this report. The domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains registered, and threat actors may repurpose it for future campaigns. Users who accessed the domain prior to its takedown should assume potential credential exposure and take remedial actions, including password resets and multi-factor authentication (MFA) enforcement on Google accounts. Organizations are advised to monitor for residual connections to the domain or IP and update blocklists to prevent future access attempts. The elevated risk level persists due to the domain’s registration retention and historical malicious activity.