polymarket[.]beefy[.]bar

polymarket.beefy.bar is currently listed as an offline site that was used for brand impersonation of Google. The domain was registered on 2025-10-01 through Dynadot LLC and resolves to the IP address 142.251.40.196, which belongs to AS15169 owned by Google LLC and is located in the United States. The hosting appears to be provided by Cloudflare, as indicated by the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed for the site, meaning HTTPS connections would have been unavailable. The page title returned by the HTTP response was “Google”, matching the declared target brand and confirming the intent to mimic the legitimate service.

The domain appears on a single security blocklist, PhishDestroy, and received a Gridinsoft trust score of 0 out of 100, reinforcing the malicious classification. VirusTotal analysis shows that four of ninety‑five scanners flagged the domain, providing independent vendor corroboration. The lack of additional detections does not imply safety, given the presence of other indicators. Defenders should continue to block the domain at network perimeter and ensure that any existing client‑side cookies or credentials potentially exposed before takedown are revoked.

Because the infrastructure uses Google‑owned IP space, static IP blocking alone may cause collateral impact; instead, rule sets should target the fully qualified domain name and its Cloudflare name servers. Monitoring for new domains registered under the same registrar or with similar sub‑domain patterns is recommended, as the threat actor may attempt to recreate the impersonation campaign. At present, the site is offline, but the observed infrastructure suggests a low‑cost impersonation technique that can be rapidly redeployed. Continuous threat‑intel feeds should be consulted for any re‑appearance of polymarket.beefy.bar or associated indicators.