hub-sentient[.]cfd

On July 24, 2026 analysts observed that the domain hub-sentient.cfd continues to resolve to the IP address 142.250.80.68, which belongs to AS15169 Google LLC in the United States. The domain was created on November 10, 2025 and registered through Dynadot LLC. DNS resolution uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the site presents a TLS certificate issued by Google Trust Services under the WE1 label, suggesting an attempt to leverage legitimate Google PKI for credibility. HTTP requests return a 502 status code, indicating a gateway error, while the underlying page title is simply "Google". Detected web technologies include Bootstrap, jQuery, Cloudflare, and the use of HTTP/3, all of which are common on legitimate sites but also frequently employed by malicious actors to blend in with normal traffic.

Threat intelligence sources have flagged hub-sentient.cfd as a brand-impersonation campaign targeting Google. Five of ninety-five VirusTotal scanners currently raise detections, and the domain appears on a single public blocklist. The phishing-defense service PhishDestroy has already added the domain to its block list, confirming that at least one security vendor has taken mitigative action. Despite these indicators, the domain remains active as of the report date.

The primary uncertainty concerns the exact malicious payload or credential-harvesting mechanism, as the captured content consists only of the page title "Google" and no further page analysis is available. Consequently, defenders should treat the domain as high-risk and enforce blocking at both network and endpoint layers. Recommended actions include adding hub-sentient.cfd to internal DNS and URL filtering policies, monitoring outbound connections to the associated IP address, and reviewing any authentication attempts that reference Google credentials originating from this host.