polkadot[.]beefy-hub[.]sbs

Analysis of polkadot.beefy-hub.sbs indicates a confirmed brand‑impersonation campaign targeting Google users. The domain was registered on 25 October 2025 through Dynadot LLC and resolves to IP 142.250.181.228, which belongs to AS15169 Google LLC in the United States. Despite the IP being owned by Google, the domain is unrelated to the legitimate Google infrastructure; it is hosted on Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, leaving the site accessible only via HTTP, which further reduces credibility.

VirusTotal records show that 16 of 95 scanned security vendors flag the domain as malicious, and it appears on a single external blocklist. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. The page title returned by the server is “Google”, matching the declared brand target and confirming the impersonation intent. The site has been taken offline and is listed as blocked by PhishDestroy, but the historical infrastructure remains observable.

Uncertainties include the exact payload delivered to victims, as the site content has not been captured, and whether any credential‑stealing forms were ever served before takedown. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor outbound connections to the associated IP for any residual activity, and update internal threat intel feeds with the observed indicators (domain, IP, nameservers, registration details, and detection counts). Because the hosting IP is owned by Google, any false positive blocks should be reviewed carefully, but the combination of brand‑impersonation page title, low trust score, and multiple vendor detections warrants a high‑confidence block.