hub-unich[.]cfd

Analysis of hub-unich.cfd shows a newly registered domain (created November 06, 2025) that is actively being used for brand impersonation of Google. The domain resolves to IP address 142.250.185.68, which belongs to AS15169 Google LLC in the United States, indicating that the attacker is leveraging legitimate Google infrastructure to increase credibility. The site presents a HTTP 502 response, suggesting that the backend service is misconfigured or intentionally returning an error page, which is a common tactic to obscure malicious content while still allowing the domain to be reachable. The TLS certificate is issued by Google Trust Services under the WE1 certificate profile, further reinforcing the illusion of authenticity.

Infrastructure details reveal the use of Cloudflare as a DNS and CDN provider, with nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the presence of Cloudflare Browser Insights, HTTP/3, Bootstrap, and jQuery in the page stack. The domain is listed on the PhishDestroy blocklist, confirming that at least one security vendor has identified it as malicious, and VirusTotal reports four detections out of ninety‑five scanners, providing additional corroboration of its threat status. Registration was performed through Dynadot LLC, a registrar often used for both legitimate and malicious domains, indicating no immediate red flag from the registrar alone.

While the exact malicious payload or credential‑harvesting page has not been captured, the convergence of a Google‑issued certificate, Google‑owned IP address, and the explicit brand targeting in the page title "Google" constitute strong evidence of a high‑risk impersonation campaign. Defenders should block hub-unich.cfd at the DNS and proxy layers, monitor outbound connections to the associated IP for anomalous activity, and update any web filtering rules to include the domain.