eul[.]portal-hubs[.]lat

Analysis on eul.portal-hubs.lat indicates that the domain was created on 21 October 2025 and is presently taken offline. The site resolves to 142.250.65.228, an address owned by AS15169 Google LLC in the United States, which suggests the attacker deliberately leveraged legitimate Google infrastructure to host the malicious content. Registration was performed through Dynadot LLC, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed. No TLS certificate was presented, meaning connections would be plain HTTP, which may facilitate credential capture or redirect attacks.

The page title returned by the server is “Google”, matching the declared brand target and confirming the classification as a Google brand impersonation campaign. VirusTotal records show that seven of ninety‑five scanning engines flagged the domain, and the domain appears on one external security blocklist. PhishDestroy has also listed the domain as blocked, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. The lack of SSL, the low trust score, and the presence on multiple blocklists collectively indicate a high likelihood of malicious intent.

However, the offline status limits current visibility into the exact payload or credential‑harvesting mechanisms employed. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the eul.portal‑hubs.lat pattern, and consider adding the associated IP address to deny lists. Ongoing intelligence collection should focus on any re‑appearance of the domain, changes in hosting configuration, or emergence of related domains that reuse the same nameservers or registration details.