drug-hub-darknet[.]com

On July 24, 2026 investigators observed that the domain drug-hub-darknet.com was registered on 22 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers elly.ns.cloudflare.com and neil.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.9.148, which is associated with AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented for the site, indicating that HTTPS is not configured. The page title returned from the HTTP response reads “DrugHub Official Links 2026 | Verified Market URL”, suggesting an attempt to present itself as a legitimate “DrugHub” marketplace.

The domain is currently listed as offline, and it has been added to a single security blocklist, specifically PhishDestroy. VirusTotal analysis shows that three of ninety‑five security vendors flagged the domain, providing additional corroboration of malicious intent. The lack of a certificate, the recent registration date, and the use of Cloudflare’s shared infrastructure are consistent with typical abuse patterns for short‑lived phishing infrastructure.

However, no further public telemetry such as Safe Browsing, OTX, or additional blocklist entries are available, leaving the full scope of distribution unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP address or name‑server pair, and consider adding the domain to internal blacklist feeds. Because the site is offline, any active credential‑harvesting capability is presently unavailable, but the infrastructure may be re‑used for future campaigns, so ongoing vigilance is recommended.