polkadot[.]beefyhubs[.]bond

Analysis of polkadot.beefyhubs.bond indicates a brand‑impersonation campaign targeting Google. The domain was registered on 26 October 2025 through Dynadot LLC and resolves to the IP address 142.250.184.228, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting infrastructure is fronted by Cloudflare, as shown by the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, leaving the site exposed to clear‑text interception and confirming the absence of HTTPS. A trust‑score from Gridinsoft rates the domain at 0 out of 100, indicating a highly suspicious reputation.

The page title returned by the server is the generic string “Google”, matching the declared brand target and reinforcing the impersonation claim. VirusTotal scans have recorded detections by four of ninety‑five antivirus vendors, and the domain appears on a single public blocklist, currently blocked by PhishDestroy. The site has been taken offline, and its current HTTP status is unavailable. The limited detection count on VirusTotal suggests that the payload, if any, has not been widely distributed, but the presence of any vendor flagging underscores malicious intent. The single blocklist entry demonstrates that at least one anti‑phishing community has recognized the domain, yet the lack of broader blocklist coverage leaves a window for accidental exposure before broader detection.

Absence of SSL also prevents browsers from issuing security warnings that could deter users. The combination of a reputable IP range, Cloudflare DNS, and a null trust score creates a classic evasion pattern designed to exploit user trust in well‑known services. Defenders should add the domain to internal block lists, monitor DNS queries for the associated Cloudflare nameservers, and consider flagging any traffic to the resolved IP that does not originate from known Google services.