degen[.]portal-hubs[.]sbs

The domain degen.portal-hubs.sbs was observed hosting a brand‑impersonation page that presents the page title "Google" and claims to represent Google. Infrastructure analysis shows the domain is delegated to the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and resolves to the IP address 142.250.74.196, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Registration data indicates the domain was created on 21 October 2025 through the registrar Dynadot LLC. No TLS certificate was found, confirming that the site was served over plain HTTP before being taken offline.

Threat‑intel sources have listed the domain on two blocklists, PhishDestroy and ScamSniffer, and the Gridinsoft trust score is recorded as 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scanned the domain and five of ninety‑five security vendors flagged it as malicious, reinforcing the suspicion of abuse. The site’s current status is offline, limiting immediate access but leaving the possibility of re‑use or resurrection.

Defenders should proactively block the domain at perimeter and endpoint layers, monitor the associated IP range for any future activity, and add the domain to internal threat‑intel feeds. Continuous observation of Cloudflare name‑server changes and registrar updates is advised, as adversaries may re‑register the name or shift hosting to evade detection.