tia[.]portal-hubs[.]lat

This report analyzes the domain tia.portal-hubs.lat, which was identified as an impersonation scam targeting the Gmail brand. The site's page title was "Google," indicating an attempt to mislead visitors into believing they were accessing a legitimate Google or Gmail service. The threat posed by this domain is credential theft, as impersonation pages of this nature are designed to capture user login information.

Technical analysis reveals that the domain was registered on 2025-10-21 through the registrar Dynadot LLC. VirusTotal flagged the site with 6 detections out of 95 security vendors, and it was specifically flagged by ChainPatrol, CRDF, G-Data, Seclookup, and SOCRadar. The domain resolved to IP address 142.250.185.100, located in the United States and associated with AS15169 Google LLC, though the site itself was not hosted on legitimate Google infrastructure. No SSL certificate was present, and the domain used nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. A single blocklist entry was recorded.

The domain is currently DOWN/OFFLINE, with a GridinSoft trust score of 0 out of 100 and a DOM risk score of 25. Although the site is inactive, the risk level remains moderate due to the impersonation of a widely trusted brand and the potential for the domain to be reactivated for future phishing campaigns.