hub-snapshot[.]lat

The domain hub-snapshot.lat was registered on 25 November 2025 through Dynadot LLC and currently resolves to IP address 142.251.140.164, which belongs to AS15169 Google LLC in the United States. The site presents a page title of “Google” and is classified as a brand‑impersonation campaign targeting Google, with the HTTP response returning a 502 status code. Infrastructure analysis shows the domain is served behind Cloudflare, utilizing HTTP/3, and uses the Cloudflare nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating the use of a legitimate certificate chain. Threat intelligence flags the domain on a single security blocklist and it is actively blocked by PhishDestroy. VirusTotal reports two detections out of ninety‑five scans, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. While the exact content of the landing page has not been observed, the combination of brand‑impersonation labeling, low trust score, and partial VirusTotal detections suggests a high‑risk indicator. Defenders should block the domain at the network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal blocklists. Continued observation of any changes to the SSL certificate, response codes, or additional detections is advised to adjust mitigation measures promptly.