folks[.]beefy-hub[.]lat

The domain folks.beefy-hub.lat is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. As of the latest verification, folks.beefy-hub.lat has been taken offline.

Technical indicators confirm the malicious nature of folks.beefy-hub.lat. The domain was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, and is listed on Google Safe Browsing for 'SOCIAL_ENGINEERING'. It appears on 1 security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100. Registered through Dynadot LLC on October 25, 2025, the domain resolved to the IP address 142.250.185.100, hosted on Google LLC's infrastructure (AS15169) in the US. No SSL certificate was available, and the observed page title was 'Google'. Nameservers for the domain are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who may have interacted with folks.beefy-hub.lat should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google Safe Browsing, the registrar (Dynadot LLC), and relevant security organizations like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.