plume[.]beefyhubs[.]bond

The domain plume.beefyhubs.bond is a phishing site engaged in brand impersonation, specifically targeting Facebook users. It presents itself as a legitimate Facebook login page to deceive victims into entering credentials, constituting a credential-harvesting scam. No crypto drainer kit was identified. The site is currently taken offline, but prior activity confirms its malicious intent.

Technical indicators confirm the elevated risk posed by plume.beefyhubs.bond. The domain was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through Dynadot LLC on October 26, 2025, it resolved to the IP address 142.250.188.4, hosted by Google LLC in the US. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100, further indicating its malicious nature.

Victims of plume.beefyhubs.bond should immediately change their Facebook passwords and enable two-factor authentication (2FA) to secure their accounts. Monitor for unauthorized activity, such as logins from unfamiliar locations or devices. Report the domain to Facebook’s abuse team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in takedown efforts. If financial or personal data was compromised, consider contacting relevant institutions to prevent fraud.