hub-snapshot[.]cyou

The domain hub-snapshot.cyou was registered on November 25, 2025 through Dynadot LLC. It is hosted on Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com and resolves to the IP address 142.251.40.164, which belongs to AS15169 Google LLC and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, and the site negotiates HTTP/3.

Security telemetry shows the domain is currently active and classified as a high‑risk brand‑impersonation campaign targeting Google. VirusTotal reports that eight out of ninety‑five scanning engines flag the domain as malicious. It is listed on one public blocklist and has been blocked by the PhishDestroy service. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

The HTTP response is a permanent redirect (301) and the page title returned is simply “Google”, matching the declared brand target. The combination of a Google‑issued certificate, an IP address owned by Google, and the use of Cloudflare infrastructure is a common tactic to lend credibility to impersonation attempts. However, the presence of a low trust score and multiple vendor detections indicates that the site is likely being used to harvest credentials or deliver further malicious payloads, even though the exact payload or phishing page content has not been observed.

Defenders should block hub-snapshot.cyou at perimeter and DNS layers, monitor for outbound connections to the resolved IP address, and update detection signatures to include the observed certificate fingerprint and Cloudflare nameserver pattern. Continuous monitoring of the domain’s reputation on additional blocklist feeds is advised, as the campaign remains active and may evolve to target additional Google services.