hub-destra[.]cfd

Analysis of hub-destra.cfd indicates a confirmed brand‑impersonation campaign targeting Gmail users. The domain, registered through Dynadot LLC on November 03, 2025, resolves to IP address 216.58.206.68, which is allocated to AS15169 Google LLC and geolocated to Germany. The hosting infrastructure utilizes Cloudflare services, as evidenced by the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the site supports HTTP/3. An SSL certificate issued by Google Trust Services (WE1) is present, and the page title returned by the server is "Google".

HTTP requests receive a 404 response, indicating that the malicious payload is not currently served. VirusTotal scans show six of ninety‑five security vendors flagging the domain, and it is listed on a single public blocklist. PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting a high likelihood of malicious intent. The risk level is elevated and the campaign status is offline at the time of reporting.

Defenders should continue to monitor the domain for any re‑activation, enforce blocklist rules across DNS and web filtering solutions, and consider adding the IP address to network‑level deny lists. Given the lack of observable content beyond the 404 response, the exact phishing landing page or credential‑harvesting mechanism remains uncertain; however, the presence of a legitimate‑looking SSL certificate and the use of a Google‑related page title suggest an attempt to deceive users. Ongoing surveillance of associated Cloudflare nameservers and the registrar may reveal further infrastructure reuse.