strk[.]portal-hubs[.]lat

On July 23, 2026, strk.portal-hubs.lat was observed to be taken offline after being identified as a brand‑impersonation site targeting Google. The domain was registered on October 21, 2025 through Dynadot LLC and resolves to the IP address 142.250.74.196, which belongs to the Google LLC autonomous system AS15169 and is geolocated in the United States. Despite the IP belonging to Google’s infrastructure, the domain does not present a valid SSL certificate, leaving the HTTP connection unencrypted. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. VirusTotal analysis shows that nine of ninety‑five scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abuse.

Independent blocklist monitoring confirms that the domain appears on a single security blocklist and has been added to the PhishDestroy blocklist, which is actively used by many email and web filtering solutions. Gridinsoft assigns a trust score of zero out of one hundred, reflecting an extremely low reputation. The page title returned by the web server is simply “Google”, matching the declared brand target. The evidence collectively points to a deliberate attempt to impersonate Google, likely to harvest credentials or lure users to a malicious landing page. However, the exact payload, phishing kit, or victim interaction flow has not been captured, and no HTTPS certificate or additional content was retrieved before the site was taken offline.

Consequently, the full scope of the campaign, including any associated command‑and‑control infrastructure or exfiltration endpoints, remains unknown. Defenders should immediately block DNS resolution for strk.portal-hubs.lat and add the IP address 142.250.74.196 to network‑level deny lists, recognizing that the address is shared with legitimate Google services and may require careful handling to avoid false positives.