aethir[.]portal-hubs[.]cfd

Analysis as of July 22, 2026 indicates that aethir.portal-hubs.cfd is an active brand‑impersonation infrastructure targeting Google. The domain was registered through Dynadot LLC on October 21, 2025 and is delegated to the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, meaning the site would be served over plain HTTP if reachable. DNS resolution points to IP address 142.251.179.147, which belongs to AS15169 Google LLC and resides in the United States. The hosting IP being owned by Google does not imply legitimacy; threat actors often leverage legitimate cloud providers to obscure attribution.

The page title returned by the site is the plain string “Google”, matching the declared brand target. VirusTotal scans show that two out of ninety‑five security vendors flagged the domain, indicating some level of detection, while the domain also appears on a single external blocklist and is listed by PhishDestroy as a malicious site. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The combination of brand‑impersonation labeling, blocklist presence, and low trust score qualifies the domain as an elevated‑risk indicator. Current operational status is reported as offline, which may be a temporary takedown or a deliberate shutdown after a campaign burst.

Defenders should continue to block the domain at perimeter filters, update URL‑filtering and DNS threat feeds with the observed indicators, and monitor for any re‑registration attempts that reuse the same second‑level or sub‑domain patterns. Because the infrastructure uses Cloudflare’s DNS service, additional scrutiny of related subdomains under the same nameservers may be warranted. Logging of any outbound connections to 142.251.179.147 from internal hosts is advisable, even though the IP is owned by Google, to detect possible misuse.