drug-hub[.]ltd

Analysis of drug-hub.ltd, observed on 25 July 2026, shows that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare (AS13335) with the IP address 172.67.138.156 located in the United States. The site serves a page titled “DrugHub Darknet Market | Official Secure Access Guide” and returns an HTTP 301 redirect, indicating a permanent move to another location. TLS termination is provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate certificate authority. The infrastructure stack includes Tailwind CSS, Vue.js, Unpkg, and HTTP/3, all delivered via Cloudflare’s edge network, and the authoritative nameservers are beth.ns.cloudflare.com and ben.ns.cloudflare.com. Threat intelligence flags the domain as a generic phishing operation.

PhishDestroy has added it to its blocklist, and it appears on one additional security blocklist. VirusTotal analysis shows that four of ninety‑three scanning engines have raised detections, reflecting a modest but notable malicious signal. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. No further public reports or malware samples have been linked to the site, leaving the exact payload or credential‑harvesting mechanisms unconfirmed.

Defenders should prioritize blocking traffic to drug-hub.ltd at the network perimeter and update endpoint protection signatures to include the observed IP address and associated Cloudflare edge nodes. Monitoring of DNS queries for the domain and its Cloudflare nameservers is advised, as any resolution changes could indicate a shift in hosting. Given the legitimate TLS certificate, reliance on certificate pinning alone is insufficient; correlation with threat‑intel feeds that reference the domain, its registrar, and the observed page title will improve detection accuracy.