usual[.]portal-hubs[.]cfd

The domain usual.portal-hubs.cfd is a confirmed phishing site engaged in brand impersonation targeting Google. It presented a fraudulent login page designed to harvest user credentials under the guise of the legitimate Google brand. No crypto drainer kit was observed. The site is currently taken offline, but it previously posed an elevated risk of credential theft through deceptive imitation of Google's interface.

Technical indicators confirm the malicious nature of usual.portal-hubs.cfd. At the time of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 21, 2025, and resolved to the IP address 142.250.186.36, located in the US under AS15169 (Google LLC). It appeared on 1 security blocklist (PhishDestroy) and had no SSL certificate issued. The observed page title was 'Google', and nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100, further indicating its fraudulent intent.

Users who interacted with usual.portal-hubs.cfd should immediately change their Google account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or changes to settings. Report the phishing domain to Google via their official reporting page and to anti-phishing organizations like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.