bnc[.]portal-hubs[.]lat

Analysis as of July 24 2026 shows that the domain bnc.portal-hubs.lat has been taken offline but remains a confirmed Google brand‑impersonation infrastructure. The site presented a page title of “Google” and explicitly impersonates Google according to the intelligence feed. Registration data reveals the domain was created on 21 October 2025 through Dynadot LLC, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS. No TLS certificate was observed; the HTTP service responded without SSL, which may simplify detection by network controls.

The host resolves to 192.178.218.104, an address owned by AS15169 Google LLC located in the United States. Despite the IP belonging to Google’s network, the address is listed on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans report that ten of ninety‑five antivirus engines flag the domain as malicious, reinforcing the suspicion. The Gridinsoft trust score of 0 out of 100 further confirms its low credibility.

Because the domain is presently offline, active probing is not possible, but its historical presence on blocklists and the multiple vendor detections suggest it was used in a phishing campaign targeting Google users. Defenders should ensure the domain is added to DNS and web‑proxy block lists, monitor outbound connections to the associated IP, and consider updating intrusion‑prevention signatures to cover the observed Cloudflare nameserver pattern. Continuous observation of the IP reputation and any re‑registration attempts is recommended, as threat actors may reuse the same infrastructure after a short downtime.