protocolhub[.]site

This domain, protocolhub.site, was registered on February 21, 2026 through NameCheap, Inc. and is served by Cloudflare nameservers elliot.ns.cloudflare.com and mallory.ns.cloudflare.com. DNS resolution points to the address 216.24.57.251, which is associated with AS397273 belonging to Render and geolocated in the United States. An HTTPS service is present; the certificate is issued by Google Trust Services under the WE1 label, indicating a valid TLS chain. A scan on VirusTotal recorded a single positive detection out of ninety‑three vendor engines, and the domain is listed on one public phishing blocklist, currently blocked by PhishDestroy.

Automated analysis identified a Node.js stack running Express on a Render hosting environment, with Cloudflare providing HTTP/3 acceleration. When accessed, the web server returned HTTP 404, and no page title or content has been captured, so the visual payload remains unknown. The Gridinsoft trust score of zero reinforces the malicious assessment.

The domain is presently taken offline, but the infrastructure—particularly the IP address and Cloudflare name‑server configuration—remains reusable for future campaigns. Defenders should add 216.24.57.251 to network‑level deny lists, enforce DNS blocking of protocolhub.site, monitor for newly created subdomains under the same registrar and name‑server pattern, and consider rapid sinkholing of the IP if possible. Continuous re‑scanning of the domain is advised in case it becomes active again, and correlation with other Render‑hosted phishing incidents may reveal shared attacker infrastructure.