defiapp[.]portal-hubs[.]lat

The domain defiapp.portal-hubs.lat is a phishing site engaged in brand impersonation targeting Google. It presents itself as a legitimate Google service but is designed to deceive users into disclosing sensitive information or interacting with fraudulent cryptocurrency schemes. No drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk to users.

Technical indicators confirm the malicious nature of defiapp.portal-hubs.lat. The domain was registered through Dynadot LLC on 2025-10-21 14:25:19 and resolves to the IP address 142.250.185.100, hosted on Google LLC's infrastructure (AS15169). Security vendors flagged the domain, with 3 of 95 VirusTotal vendors detecting it as malicious, including ChainPatrol, CRDF, and SOCRadar. It appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100. The site lacks an SSL certificate, and its nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The observed page title was 'Google', reinforcing its impersonation tactic.

Users who interacted with defiapp.portal-hubs.lat should take immediate action to secure their accounts and assets. For cryptocurrency-related scams, revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. If credentials were entered, change passwords for the affected accounts, enable two-factor authentication, and monitor for unauthorized activity. Report the domain to Google’s Safe Browsing team, the registrar Dynadot LLC, and platforms like PhishTank or the Anti-Phishing Working Group to aid in takedown efforts.