sxt[.]portal-hubs[.]sbs

Analysis of sxt.portal-hubs.sbs, observed as offline at the time of review, identifies a brand‑impersonation campaign targeting Google. The site’s HTML title resolves to “Google”, matching the declared brand target. The domain was registered on 21 October 2025 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, indicating that the site does not serve content over HTTPS. DNS resolution points to IP 142.250.185.68, which belongs to AS15169 owned by Google LLC and is geolocated in the United States.

The same IP is associated with legitimate Google infrastructure, suggesting that the malicious operator is leveraging a legitimate Google address, possibly through a compromised host or a misconfigured DNS record. The domain appears on one security blocklist and has been flagged by PhishDestroy as taken offline. VirusTotal reports that 7 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity despite the limited detection count. Gridinsoft assigns a trust score of 0 / 100, indicating an extremely low reputation. The absence of an SSL certificate, combined with the use of a high‑reputation IP, may be an attempt to evade automated TLS‑based filters.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanism because no page content has been captured. Defenders should block DNS resolution for sxt.portal-hubs.sbs at the network perimeter, add the domain to URL filtering and web‑proxy block lists, and monitor for outbound connections to the associated IP address for any anomalous traffic patterns. Given the legitimate ownership of the IP, correlation with other indicators such as unusual HTTP user‑agent strings or repeated failed login attempts to Google services may help isolate compromised clients.