johnstonhubpartners[.]com

johnstonhubpartners.com was registered on 19 January 2025 through Porkbun LLC and uses the Porkbun nameservers curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. DNS resolution points to 34.68.234.4, an address owned by Google LLC (AS396982) and geolocated to the United States. The site presented the page title “SBE Digital” but did not serve an SSL/TLS certificate, indicating HTTP‑only access. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, both of which are consistent with malicious intent.

Independent blocklist providers PhishDestroy and ScamSniffer have listed the domain, and it appears on two additional security blocklists. The current operational status is offline, and the site is no longer reachable. The available evidence points to a generic phishing operation that likely leveraged the “SBE Digital” title to lure victims, although the exact content and targeted brand have not been captured. Because the domain resolves to infrastructure shared with other Google‑hosted services, defenders should not assume the IP is exclusive to the malicious actor, but the specific host‑header and URL patterns observed during the brief availability should be added to web‑filter rules.

Immediate actions include adding johnstonhubpartners.com to DNS‑sinkhole or firewall deny lists, blocking traffic to 34.68.234.4 for the duration of the investigation, and updating email gateway signatures to drop any messages containing URLs to this domain. Continuous monitoring of the registrar’s new registrations and of the same nameserver set is advised, as threat actors frequently recycle similar infrastructure. Analysts should also watch for future registrations that reuse the “johnstonhubpartners” lexical pattern or that resolve to the same Google ASN, and incorporate these indicators into threat‑intel feeds.