sca[.]portal-hubs[.]lat

Analysis of sca.portal-hubs.lat indicates a brand‑impersonation campaign targeting Google. The domain was registered on October 21 2025 through Dynadot LLC and resolves to the IP address 142.250.184.196, which belongs to AS15169 Google LLC in the United States. The hosting infrastructure uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate is presented, meaning the site would be served over plain HTTP if accessed. The page title returned by the server is “Google,” matching the declared brand target.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has already taken the domain offline, and at the time of analysis it is not reachable. VirusTotal reports that six of ninety‑five scanning engines flag the domain as malicious, confirming that multiple independent vendors have observed suspicious characteristics. The combination of a recent registration date, use of Google‑owned IP space, lack of encryption, and low trust rating strongly suggests a deliberate attempt to deceive users by masquerading as a legitimate Google service.

Defenders should continue to block the domain at perimeter filters, update any URL‑allow lists, and monitor for future resurrection or similar domains that use the same naming pattern or Cloudflare nameservers. Additional investigation of HTTP response headers, potential redirect chains, and any payload delivered before the takedown would be advisable should the site become active again. Until the domain remains offline, no further payload analysis can be performed, and the current evidence is limited to infrastructure and reputation indicators.