zircuit[.]portal-hubs[.]lat

Analysis of the domain zircuit.portal-hubs.lat indicates a brand‑impersonation campaign targeting Google users. The domain was registered on October 21, 2025 through Dynadot LLC and is configured with Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is presented, leaving the connection unencrypted. DNS resolution points to IP address 172.217.165.132, which is owned by Google LLC (AS15169) and located in the United States, a tactic often used to lend legitimacy to malicious pages.

The HTTP response, as observed before takedown, returned a page title of "Google," reinforcing the impersonation claim. Infrastructure signals include a Gridinsoft trust score of 0 / 100 and a detection rate of 14 out of 95 security vendors on VirusTotal, confirming that multiple scanners flagged the domain as malicious. The site appears on at least one security blocklist and has been actively blocked by PhishDestroy, leading to its current offline status.

While the content of the site has not been captured, the combination of brand targeting, spoofed page title, and low trust metrics strongly suggests a phishing or credential‑harvesting operation. Defenders should continue to monitor for any resurgence of the domain, enforce blocking at network perimeter and DNS filtering layers, and consider adding the domain to internal blacklists. Additional investigation of any related subdomains or future registrations that reuse the same nameserver set is advised, as threat actors often recycle infrastructure to evade detection.