cow[.]portal-hubs[.]lol

Analysis indicates that the domain cow.portal-hubs.lol was registered on October 21, 2025 through Dynadot LLC. The domain resolves to the IP address 172.217.18.4, which belongs to AS15169 Google LLC and is located in the United States. Despite sharing infrastructure with a legitimate Google address, the site presents a page title of “Google”, matching the declared brand target. No TLS certificate is offered, meaning connections are unencrypted, a characteristic often observed in transient impersonation infrastructures. The domain appears on a single security blocklist and is actively blocked by PhishDestroy.

Independent scoring services assign extremely low trust values: Gridinsoft rates it 0/100 and Scamadviser 1/100. VirusTotal reports that 7 out of 95 scanned security vendors have flagged the domain, reinforcing the suspicion. The nameservers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, typical of Cloudflare‑based hosting. The site is classified as a brand‑impersonation scam targeting Google, and its current status is offline, suggesting that the operators have taken it down or that mitigation actions succeeded.

However, the infrastructure – shared IP space, Cloudflare DNS, and the registrar – may be reused for future campaigns. Threat hunters should scrutinize traffic to 172.217.18.4 for anomalous request patterns, even though the address is generally associated with legitimate services. Defenders should add cow.portal-hubs.lol to URL filtering and DNS blocklists, monitor for new domains using the same registrar or nameserver pattern, and enforce strict TLS inspection policies to detect any future attempts to serve content from the same IP without encryption. Continuous watch of threat‑intel feeds for related indicators such as the ASN, nameservers, and the specific blocklist entry is recommended to pre‑empt re‑deployment.