polkadot[.]beefy-hub[.]lat

On 23 July 2026 analysts observed the domain polkadot.beefy-hub.lat being used in a brand‑impersonation campaign targeting Google users. The site presents a page title of “Google,” which aligns with the declared impersonation of the Google brand. Registration data show the domain was created on 25 October 2025 and was registered through Dynadot LLC. DNS resolution points to the IP address 142.251.140.164, an address owned by Google LLC (AS15169) located in the United States. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the infrastructure is fronted by a content‑delivery network.

No SSL certificate was observed, leaving the connection unencrypted. Reputation services indicate a Gridinsoft trust score of 0 out of 100, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 12 of 95 scanned security vendors flagged the domain as malicious. The current operational status is offline, suggesting the malicious site has been taken down or is no longer serving content.

Evidence confirms the domain’s intent to masquerade as a Google service, yet the exact payload or credential‑harvesting mechanisms remain unverified because the site was not captured before removal. Defenders should continue to monitor DNS queries for the IP 142.251.140.164 and the associated Cloudflare name servers, enforce strict TLS validation to mitigate exposure to unencrypted sites, and update URL filtering policies to include polkadot.beefy‑hub.lat on blocklists. Incident response teams should also examine historic logs for any access attempts from internal users to this domain and consider user awareness campaigns that highlight the lack of a valid SSL certificate and the mismatched host name. Ongoing collaboration with threat‑intel feeds such as PhishDestroy and VirusTotal is recommended to capture any re‑emergence of the domain or related infrastructure.