plume[.]portal-hubs[.]lat

Analysis indicates that the domain plume.portal-hubs.lat was registered on October 21, 2025 through Dynadot LLC and resolves to the IP address 216.58.206.36, which belongs to the Google LLC AS15169 network located in Germany. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was presented when the site was queried, suggesting the service was operating without HTTPS. The page title returned “Google”, and the threat classification is listed as brand impersonation targeting Google.

The domain appears on a single security blocklist and has been flagged by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that six of ninety‑five scanners flagged the domain, reinforcing the malicious assessment. Current status is offline, and the site is no longer reachable.

Defenders should continue to block traffic to the IP 216.58.206.36 when associated with the host header plume.portal-hubs.lat, enforce DNS sink‑hole rules for the domain, and monitor for any resurgence of the host. Because the domain leverages legitimate Google infrastructure, any future re‑use could bypass simple IP‑based allowlists, so correlation with the specific host name is essential. Additional investigation should verify whether the domain ever served a login page or captured credentials, but the existing evidence—registration data, lack of SSL, low trust score, and multiple vendor detections—justifies treating plume.portal-hubs.lat as a confirmed Google impersonation threat and applying appropriate mitigation across email gateways, web proxies, and endpoint protection solutions.