euler[.]portal-hubs[.]sbs

On 24 July 2026 the domain euler.portal-hubs.sbs was observed being used in a brand‑impersonation campaign targeting Google. The site was registered through Dynadot LLC and created on 21 October 2025. DNS resolution points to 142.250.186.132, an address owned by AS15169 Google LLC in the United States, and the domain is served by the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented, indicating that the site operated over plain HTTP.

Reputation services flag the domain as highly malicious: Gridinsoft assigns a trust score of 0 / 100, PhishDestroy has listed it as blocked, and it appears on one public security blocklist. VirusTotal analysis shows that 8 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. The page title returned by the web server is “Google”, matching the declared brand target.

The domain is currently offline, and the hosting infrastructure appears to be co‑located with legitimate Google IP space, a tactic often used to increase credibility. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the indicator set (domain, IP, nameservers, registrar) to threat‑intel feeds. Because the site is already taken down, further forensic collection is limited; however, the lack of SSL and the use of legitimate‑looking infrastructure remain key indicators for future detection.