wlfi[.]portal-hubs[.]lat

This domain, wlfi.portal-hubs.lat, is identified as a brand impersonation threat designed to deceive users into believing they are interacting with Google. The site mimics legitimate Google login pages, potentially harvesting credentials or distributing malicious payloads under the guise of official branding. Users who enter sensitive information may expose themselves to account compromise, unauthorized access, or further exploitation by threat actors. Analysis indicates the domain was registered on October 21, 2025, through Dynadot LLC, a registrar frequently observed in phishing infrastructure. Technical indicators reveal the site resolves to the IP address 142.250.72.100, though this address is also associated with legitimate Google services, complicating network-based detection. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was proactively blocked by at least one threat intelligence platform. If you visited wlfi.portal-hubs.lat or entered credentials on the site, immediate action is required. Disconnect the device from the network to prevent potential lateral movement or data exfiltration. Reset passwords for any accounts accessed from the compromised device, prioritizing Google and email accounts. Enable multi-factor authentication where available. Scan the device using updated security tools to detect and remove any installed malware. Monitor financial and communication accounts for unauthorized activity, and report the incident to relevant security teams or platforms for further mitigation.