cetus[.]portal-hubs[.]cfd

This domain, cetus.portal-hubs.cfd, poses a credential harvesting threat by impersonating Google’s authentication interface. Analysis indicates the site was designed to deceive users into entering sensitive login details, which are then captured by threat actors for unauthorized access or further malicious activity. The page title explicitly displays "Google," reinforcing the impersonation tactic to exploit user trust in the brand. Infrastructure analysis reveals the domain was registered on October 21, 2025, through Dynadot LLC, a registrar frequently observed in phishing campaigns. Detection metrics confirm its malicious nature, with 11 out of 95 security vendors on VirusTotal flagging the domain as dangerous. Additionally, the domain appears on one security blocklist and resolves to the IP address 172.217.18.4, which may be part of a broader infrastructure used to host fraudulent content. Users who visited cetus.portal-hubs.cfd should immediately revoke any entered credentials by changing their Google account password and enabling multi-factor authentication. Review recent account activity for unauthorized logins or suspicious actions. If financial or sensitive data was submitted, monitor associated accounts for signs of compromise. Clearing browser cache and running a full system scan with updated security tools is recommended to detect potential secondary infections or residual threats.