defiapp[.]beefyhubs[.]click

defiapp.beefyhubs.click is a newly registered domain (created 22 Oct 2025) that masquerades as Google, as indicated by its page title “Google” and the declared brand target. The site resolves to 142.251.140.164, an address owned by AS15169 Google LLC and located in the United States. Hosting is provided through Cloudflare, using the nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, meaning the site operates without HTTPS encryption. The registrar listed is Dynadot LLC. VirusTotal analysis shows that four out of ninety‑five scanning engines flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of malicious intent.

The domain appears on a single public blocklist, PhishDestroy, and has been taken offline at the time of reporting. The scam type is identified as a crypto scam, suggesting that the impersonation of Google may be used to lure victims into cryptocurrency‑related fraud. Evidence from the available intelligence confirms the brand impersonation but does not reveal the exact payload or credential‑collection mechanism, as the live site is no longer reachable. Defenders should immediately add defiapp.beefyhubs.click to deny‑list rules in firewalls, DNS filters, and endpoint protection suites.

Monitoring for future DNS resolution to the same IP range or for newly created domains using the same registrar and similar sub‑domain patterns is advised. Because the hosting provider is Cloudflare, any related abuse reports should be filed with Cloudflare Abuse Contact to expedite takedown. Continuous review of threat‑intel feeds for additional indicators tied to the identified IP, nameservers, or the “Crypto Scam” tag will help detect replication attempts. Until the site is confirmed permanently removed, organizations should treat any traffic to the domain as malicious and block it at the perimeter.