send[.]portal-hubs[.]lat

The domain send.portal-hubs.lat was registered through Dynadot LLC on October 21, 2025 and is currently taken offline. Technical analysis shows the domain resolves to IP address 142.250.185.164, which is owned by AS15169 Google LLC and geolocated in the United States. No SSL certificate is presented for the site, and the HTTP response lacks HTTPS support. The page title returned from the host is "Google," matching the declared brand target of Google and confirming the classification as a brand impersonation campaign.

VirusTotal scanning indicates that nine of ninety‑five security vendors flagged the domain as malicious, and the domain appears on a single security blocklist maintained by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, underscoring a lack of legitimacy. Nameservers are listed as brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS infrastructure.

While the domain’s offline status limits active probing, the combination of vendor detections, blocklist inclusion, zero trust score, and brand‑targeted page title provides a clear indicator of malicious intent. Defenders should add the domain and its associated IP address to network deny‑lists, monitor for any future re‑registration or resurrection attempts, and consider extending blocklist rules to cover the observed Cloudflare nameservers. Continuous surveillance of other domains registered through Dynadout and any new hostings on the same IP range is recommended to pre‑empt potential re‑use by the same threat actor.