polymarket[.]beefy-hub[.]lol

Analysis of polymarket.beefy-hub.lol confirms it as a phishing domain impersonating Google, with elevated risk indicators and confirmed takedown status as of July 23, 2026. The domain, registered on October 25, 2025, through Dynadot LLC, was flagged by 14 of 95 security vendors on VirusTotal and blocked by PhishDestroy. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and resolution to IP 142.250.186.100, geolocated in Germany under AS15169 (Google LLC).

Notably, the domain lacks an SSL certificate, a common red flag for fraudulent sites, and its page title explicitly displays 'Google,' aligning with the brand impersonation scam type documented in threat intelligence feeds. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist. While the exact phishing kit or payload remains unconfirmed, the combination of brand impersonation, missing encryption, and detection by multiple vendors strongly suggests malicious intent.

Defenders should treat this domain as compromised and prioritize blocking it at DNS, proxy, and endpoint layers. The current offline status indicates possible remediation, but historical resolution data should be preserved for forensic analysis. No evidence links this domain to legitimate Google infrastructure, despite the IP association with Google LLC, which may reflect hosting or routing artifacts rather than ownership.