hub-cysic[.]cfd

Analysis of hub-cysic.cfd shows a high‑risk brand‑impersonation infrastructure targeting Google users. The domain was registered on November 5, 2025 through Dynadot LLC and is still active as of the report date, July 22, 2026. DNS resolution points to 172.217.18.4, an IP address owned by AS15169 Google LLC located in the United States, yet the domain is served via Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, which is unusual given the domain’s external registrar and Cloudflare front‑end.

HTTP responses return a 502 status, indicating a gateway error, and the page title reported by the scanner is simply "Google". Fingerprinting tools identified the use of Bootstrap, jQuery, Cloudflare and HTTP/3, all common in legitimate services but also frequently leveraged by malicious operators to blend in with normal traffic. VirusTotal analysis shows four of ninety‑five security vendors flagging the domain, and it appears on one public blocklist, with PhishDestroy already listing it as blocked.

While the IP belongs to Google, the combination of a third‑party registrar, Cloudflare DNS, a mismatched certificate, and the detection signals collectively suggest a deliberate attempt to masquerade as a Google login or service page. Defenders should immediately add hub‑cysic.cfd to URL filtering and DNS blocklists, monitor outbound connections to the associated IP for anomalous activity, and consider sinkholing the domain at the DNS level. Continuous re‑scanning is advised to capture any changes in the site’s content or hosting configuration, and security teams should alert end users about the potential for credential harvesting linked to this domain.