aethir[.]portal-hubs[.]lat

The domain aethir.portal-hubs.lat was observed hosting a page whose HTML title is exactly "Google". The site is classified as a brand‑impersonation campaign targeting Google, consistent with the supplied brand target. Registration data show the domain was created on 21 October 2025 and was registered through Dynadot LLC. Technical resolution points the domain to IP address 142.250.185.164, an address owned by Google LLC (ASN 15169) located in the United States. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was presented when the site was queried, indicating the service was operating over plain HTTP. The page is currently taken offline, but historical scans indicate that 7 out of 95 VirusTotal security vendors flagged the domain as malicious.

The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service. Independent analysis from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. No additional intelligence such as malware kit identifiers, OTX references, or Safe Browsing verdicts is available for this host. The combination of a Google‑related page title, the use of a Google‑owned IP address, and the brand‑impersonation label suggests the operator attempted to exploit the trust associated with Google’s infrastructure.

However, the absence of a TLS certificate and the reliance on Cloudflare DNS may indicate a short‑lived hosting setup. Defenders should continue to monitor DNS queries for aethir.portal-hubs.lat and block the domain at perimeter defenses, including web filtering and intrusion‑prevention systems. Given the domain’s presence on a blocklist and the low trust score, adding it to internal blacklists is advisable.