hub-gokite[.]cfd

hub-gokite.cfd is a brand‑impersonation site targeting Google. The domain was registered through Dynadot LLC and uses the Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 172.253.115.105, an address owned by AS15169 Google LLC in the United States, indicating that the operator leveraged legitimate Google infrastructure for hosting. The domain was created on 06 Nov 2025 and has since been listed on one public security blocklist and blocked by the PhishDestroy service.

VirusTotal reports that 13 of 95 scanning engines flag the domain as malicious, and Google Safe Browsing classifies it as social‑engineering. The site presents a page title of “Google” but does not serve an SSL/TLS certificate, and the Gridinsoft trust score is 0 / 100. Current monitoring shows the domain is taken offline, but the underlying infrastructure remains reachable. Defenders should immediately add hub‑gokite.cfd to DNS and URL filtering policies, especially those protecting users from brand‑impersonation and social‑engineering threats.

Continuous observation of the associated IP address is advised, as the same Google‑owned host may be reused for other malicious domains. Given the registrar, nameserver pair, and the lack of TLS, similar future domains can be pre‑emptively blocked. Incident response teams should also verify if any credential‑phishing attempts were made using the “Google” page title and consider threat‑intel sharing with partners to improve early detection of related campaigns.