drughub-market[.]xyz

Analysis indicates that the domain drughub-market.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare‑owned address 172.67.223.178, which is associated with ASN 13335 and a US location. The presence of Cloudflare’s nameservers fred.ns.cloudflare.com and lilith.ns.cloudflare.com, together with the observed use of HTTP/3, confirms that the site relied on Cloudflare’s CDN and edge services. The TLS certificate issued by Google Trust Services (WE1) validates the HTTPS connection but does not provide any assurance about the underlying content.

The page title returned from the site, “Drughub Market — Retro‑Futuristic Darknet Marketplace,” suggests a thematic focus on illicit marketplaces, consistent with the classification of the domain as a generic phishing campaign. Independent scanning on VirusTotal recorded five detections out of ninety‑five participating scanners, indicating that multiple security engines have identified malicious characteristics. The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service, which further corroborates its malicious reputation. Because the site is currently offline, active content cannot be examined, but the available telemetry demonstrates a deliberate setup to mimic a darknet marketplace and to lure victims.

Defenders should add drughub-market.xyz to inbound and outbound web filtering rules, monitor DNS queries for the associated IP address and Cloudflare nameservers, and consider raising alerts on any TLS connections presenting the Google Trust Services WE1 certificate when the SNI matches the domain. Continuous observation of the registrar NiceNIC International Group Co., Limited may reveal additional domains registered in the same campaign. Integration of the VirusTotal detection count and blocklist status into threat intelligence platforms will help correlate future activity with this indicator.