top-druhub[.]digital

Analysis of top-druhub.digital, created on July 25 2026, shows that the domain is hosted on Cloudflare infrastructure (nameservers adel.ns.cloudflare.com, javon.ns.cloudflare.com) and resolves to IP 188.114.97.3. The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED. The SSL certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, suggesting that threat‑intelligence feeds have identified it as malicious. VirusTotal reports that the domain was scanned by 91 AV engines, with no detections returned at the time of scanning; however, the absence of detections does not guarantee benign behavior.

No public Safe Browsing, OTX, or HTTP response data have been published for this host, and page‑title information is not yet available. The short lifespan (registered only three days prior to the report) combined with the immediate blocklist presence aligns with patterns observed for newly‑registered phishing infrastructure. The risk level is currently marked as "under investigation" and the operational status is listed as active, indicating that the domain is still resolving and serving content. No evidence of a specific brand impersonation or targeted campaign has been disclosed, so the phishing classification remains generic.

Because the infrastructure relies on Cloudflare's DNS and edge network, rapid takedown may be limited, and threat actors can leverage the platform's anonymity features. Defenders should treat the domain as potentially hostile: block DNS resolution, prevent outbound connections to 188.114.97.3, and monitor for any credential‑harvesting activity that may be associated with the domain. Continuous re‑scanning with multi‑engine services is recommended, as threat actors may later add malicious payloads that current scans have not captured.