wct[.]portal-hubs[.]sbs

Analysis of wct.portal-hubs.sbs shows a short‑lived infrastructure that was used to impersonate Google. The domain was registered on 21 October 2025 through Dynadot LLC and delegated to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.181.228, an address owned by AS15169 Google LLC and geolocated to the United States. The site presented a page title of “Google”, matching the declared brand target and confirming the brand‑impersonation intent.

No TLS certificate was observed, indicating the site operated over plain HTTP. Threat‑intel feeds have listed the domain on a single security blocklist and it received a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. PhishDestroy has actively blocked the domain, and VirusTotal scans recorded three positive detections out of ninety‑five antivirus engines. The site has since been taken offline, as reflected by its current status.

Although the IP belongs to Google’s own network, the use of a Google‑owned address for a fraudulent page suggests possible abuse of legitimate infrastructure or a temporary hijack, a pattern seen in other brand‑impersonation campaigns. Defenders should continue to enforce blocklist rules for wct.portal-hubs.sbs, monitor for re‑registration, and consider adding the domain to internal URL filtering policies. Network sensors should flag any outbound connections to the associated IP address, especially from users attempting to access Google‑related services, to detect potential credential‑harvesting attempts. Ongoing correlation with threat‑intel platforms is recommended to capture any future activity that reuses the same registrar, name‑server pair, or IP range.