app[.]drchgtuj[.]top

app.drchgtuj.top is currently listed as a high‑risk generic phishing site. The domain was registered on April 11 2026 through NameSilo, LLC and remains active as of July 12 2026. The web server returns HTTP 200 and presents a page titled “Download”, a pattern commonly used to lure victims into downloading malicious payloads. DNS resolution points the domain to 188.114.97.3, an address owned by Cloudflare, Inc. The authoritative nameservers are junade.ns.cloudflare.com. and kinsley.ns.cloudflare.com., confirming that the domain is behind Cloudflare’s reverse‑proxy service. The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS connection despite the malicious intent. Threat intelligence sources have flagged the domain on at least one security blocklist and it is actively blocked by PhishDestroy. VirusTotal reports a single malicious detection out of 95 scanned vendors, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the suspicion of malicious activity. While the limited number of AV detections suggests that many scanners have not yet identified the payload, the presence on a blocklist and the zero trust score are strong indicators of risk. Defenders should treat any traffic to app.drchgtuj.top as hostile. Network sensors should block the domain and its underlying IP address, and email gateways should quarantine messages that reference the “Download” page or contain links to the domain. Continuous monitoring of Cloudflare‑associated IP ranges for similar phishing patterns is advised, and incident response teams should investigate any user interactions with the site for potential credential theft or malware infection.