soph[.]portal-hubs[.]sbs

The domain soph.portal-hubs.sbs has been identified as a brand_impersonation threat specifically targeting Gmail, a widely recognized email service provider. Analysis confirms the domain is currently offline, though prior activity exhibited characteristics consistent with credential harvesting or unauthorized account access attempts. The page title displayed as 'Google,' reinforcing the intent to deceive users into believing the site was legitimate Gmail infrastructure. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating a moderate level of detection consensus. Registered through Dynadot LLC on October 21, 2025, the domain lacked an SSL certificate, a critical security omission for any site handling user credentials. It resolved to the IP address 142.250.186.100, geolocated in Germany under AS15169 (Google LLC), though this IP association appears to be a spoofed or misconfigured routing attempt rather than legitimate hosting. The domain appeared on one security blocklist and was blocked by at least one threat intelligence feed, further corroborating its malicious classification. Current findings indicate the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure and registration patterns suggest potential for reactivation or migration to similar domains. Organizations and users are advised to monitor for newly registered domains under the portal-hubs.sbs namespace or other lookalike variations. Network-level blocking of the observed IP (142.250.186.100) and enforcement of strict SSL certificate validation are recommended. Security teams should review logs for prior connections to soph.portal-hubs.sbs and assess any credential exposure. Proactive user education on recognizing brand impersonation tactics remains critical to mitigating future threats.