eth[.]portal-hubs[.]sbs

Analysis of eth.portal-hubs.sbs shows a recently registered domain (creation date October 21 2025) that was used for a Google brand‑impersonation campaign. The site was served from the IP address 142.250.80.68, which belongs to AS15169 Google LLC and resolves to a United States location, indicating that the malicious operator deliberately leveraged legitimate Google infrastructure to lend credibility. The domain is registered via Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a pattern commonly observed in fast‑flux or proxy‑based phishing deployments. No TLS certificate was observed, leaving the site unencrypted and increasing the risk of content tampering.

The page title returned by the server is simply "Google," matching the declared brand target and confirming the impersonation intent. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scans recorded four detections out of ninety‑five scanners, and the domain appears on a single external blocklist, where it has been flagged by PhishDestroy. The current operational status is offline, suggesting the site has been taken down or is no longer active.

Defenders should continue to monitor the associated IP address and the Cloudflare name servers for any re‑use, block the domain and its IP at perimeter defenses, and add the domain to internal threat intel feeds. Because the domain leveraged a legitimate Google IP range, network‑level alerts based solely on IP reputation may miss future iterations; therefore, correlation with DNS queries for eth.portal‑hubs.sbs and inspection of HTTP responses that present a "Google" page title are recommended. Continuous re‑scanning with multi‑vendor services is advised to capture any new detections should the site be resurrected.