ewt[.]beefyhub[.]lol

The domain ewt.beefyhub.lol is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page but is designed to deceive users into disclosing sensitive information through credential phishing. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, though prior exposure may still pose a threat to affected users.

Technical indicators confirm ewt.beefyhub.lol as malicious. As of analysis, 3 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol, Fortinet, and SOCRadar. It appears on one security blocklist, PhishDestroy, and holds a Gridinsoft trust score of 0/100. The domain was registered on October 21, 2025, through Dynadot LLC and resolves to the IP address 142.250.176.196, hosted on Google LLC's AS15169 in the US. No SSL certificate is present, and the observed page title is 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing has not flagged the domain at this time.

Users who interacted with ewt.beefyhub.lol should immediately change any passwords entered on the site, particularly for Google accounts or services linked to the same credentials. Enable two-factor authentication (2FA) on all critical accounts to prevent unauthorized access. Monitor financial and account activity for signs of fraud, such as unauthorized logins or transactions. Report the phishing domain to Google’s Safe Browsing team via their reporting tool, and submit it to additional threat intelligence platforms like PhishTank or URLVoid to aid in broader detection efforts.