onion-drughub[.]com

The domain onion-drughub.com was registered on June 02, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the Cloudflare‑owned address 188.114.97.3 located in Canada. DNS resolution is handled by autumn.ns.cloudflare.com and rory.ns.cloudflare.com, and the site presents a valid Let’s Encrypt certificate (E8). The web server returns HTTP 200 and advertises a page title of “DrugHub Market | Home”, indicating a storefront‑style interface likely intended to mimic a legitimate drug marketplace.

Infrastructure analysis shows the site is built on the Bootstrap framework and is protected by Cloudflare services, including Browser Insights and HTTP/3 support. The domain has been flagged by six out of ninety‑five security scanners on VirusTotal and appears on a single security blocklist. It is also listed as blocked by the PhishDestroy mitigation system, confirming that external threat‑intel providers have identified it as a malicious resource. The combination of a recent registration, a reputable CDN front‑end, and a modest detection rate suggests a short‑lived campaign designed to evade rapid takedown.

Uncertainty remains regarding the exact content and credential‑harvesting mechanisms employed on the landing page, as the public snapshot only reveals the generic market title. Defenders should therefore treat any traffic to onion-drughub.com as high‑risk. Recommended actions include adding the domain and its IP address (188.114.97.3) to deny‑list rules at perimeter devices, monitoring DNS queries for the associated nameservers, and ensuring endpoint protection solutions are updated to recognize the current blocklist entry. Continuous re‑assessment is advised, as the short registration window may be used to rotate hosting or certificate details in future iterations of the campaign.