searchhub[.]icu

This domain, searchhub.icu, was registered on April 21, 2026, through FewMoreTaps OÜ and remains active as of July 12, 2026. Analysis indicates it is flagged as a high-risk phishing resource, with infrastructure hosted behind Cloudflare nameservers lola.ns.cloudflare.com and shane.ns.cloudflare.com. The domain resolves to IP address 104.21.84.185, geolocated in Canada under Cloudflare’s network, a common pattern observed in phishing operations leveraging CDN services to obscure origin servers and evade takedowns. Technical indicators reveal a Let’s Encrypt SSL certificate (serial E7) in use, providing encrypted HTTPS access, while the HTTP response consistently returns a 403 Forbidden status. The page title 'Just a moment...' suggests the presence of a Cloudflare security challenge or interstitial page, which may be used to filter automated security scans or redirect legitimate users to malicious content after passing anti-bot checks. The domain appears on one security blocklist and is detected by five out of ninety-five security vendors on VirusTotal, with a trust score of 0/100 from Gridinsoft, reinforcing its classification as malicious. Infrastructure analysis shows no direct association with known phishing kits or targeted brands at this time, though it has been referenced in one AlienVault OTX threat intelligence pulse. The use of Cloudflare and a recent registration date align with tactics employed by threat actors to rapidly deploy and rotate phishing infrastructure. Defenders are advised to block the domain at the DNS or proxy level, monitor for related subdomains or redirects, and inspect logs for connections to 104.21.84.185 or interactions with Cloudflare challenge pages that may precede credential harvesting or malware delivery.