arb[.]portal-hubs[.]sbs

This domain, arb.portal-hubs.sbs, is identified as a brand impersonation threat targeting Google users. The site mimics Google’s interface, as evidenced by its page title labeled "Google," and is designed to deceive visitors into disclosing credentials or sensitive information. The domain’s infrastructure and lack of legitimate authentication measures align with known phishing tactics, posing a direct risk to users who may mistake it for an official Google service. Analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on October 21, 2025, through Dynadot LLC, a registrar frequently associated with phishing domains. It currently appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines. The domain resolves to the IP address 142.250.186.132, hosted under AS15169 (Google LLC), though this likely represents spoofed or misused infrastructure rather than legitimate affiliation. Notably, the domain lacks an SSL certificate, a red flag for secure communication and further evidence of its fraudulent nature. Users who visited arb.portal-hubs.sbs should take immediate remediation steps to mitigate potential compromise. Those who entered credentials or personal information should assume their data is exposed and initiate password resets for all associated accounts, prioritizing Google services. Enable multi-factor authentication (MFA) where available to prevent unauthorized access. Monitor financial and digital accounts for suspicious activity, and report the incident to relevant security teams or incident response platforms. If the domain was accessed in a corporate environment, IT teams should conduct a forensic review of affected devices to detect any malware or persistent threats.