bluefin[.]portal-hubs[.]sbs

This domain, bluefin.portal-hubs.sbs, was registered on 21 October 2025 through Dynadot LLC. The site presents a page title of “Google” and is classified as a brand‑impersonation campaign targeting Google. Infrastructure analysis shows the domain resolves to the IP address 216.58.206.36, which belongs to AS15169 Google LLC and is geolocated in Germany. No TLS certificate is presented, indicating HTTP‑only service. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare.

Reputation services have assigned a Gridinsoft trust score of 0 / 100, and the domain appears on one public security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that four of ninety‑five scanned vendors flagged it as malicious. The current operational status is offline, and the site is no longer reachable. The available data confirms a deliberate attempt to misuse the Google brand, but the specific phishing kit, payload, or victim interaction details have not been disclosed.

Because the domain leverages legitimate Google‑owned IP space, it may evade simple IP‑based blocking if the underlying address is shared with legitimate services. Defenders should therefore enforce domain‑level blocking for bluefin.portal-hubs.sbs, add the associated IP to watch lists, and monitor for any future resolution to the same address. Updating web‑gateway and endpoint protection signatures to include the four VirusTotal detections will improve detection rates. Continuous observation of the Cloudflare nameservers for new sub‑domains is also advised, as the infrastructure could be reused for additional impersonation attempts.