darkmatter-link[.]org

Analysis of darkmatter-link.org shows a recently registered domain (created 21 Feb 2026) hosted on Cloudflare’s network (AS13335) resolving to 104.21.46.175, an IP located in the United States. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. Registration was performed through NiceNIC International Group Co., Limited, and the authoritative nameservers are ben.ns.cloudflare.com and beth.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. TLS termination is provided by Google Trust Services under the “WE1” certificate, confirming a valid HTTPS endpoint.

The public page title, “DarkMatter — The Encrypted Darknet Digital Horizon,” does not correspond to a known legitimate brand, and the site’s front‑end stack comprises Tailwind CSS, Vue.js, Cloudflare Browser Insights, and HTTP/3, all of which are common components for modern web applications but provide no indication of malicious functionality. VirusTotal records show that two of ninety‑three scanned engines flagged the domain, suggesting the presence of at least one detectable malicious element. Conversely, Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence classification as unsafe. Available evidence confirms the domain’s classification as generic phishing, yet the specific phishing lure, targeted credentials, or payload delivery mechanisms have not been disclosed.

Continuous monitoring of the IP address, DNS records, and any changes in detection counts is advised. Defenders should block the domain at perimeter filters, update URL reputation lists, and consider adding the IP to deny‑list rules. Because the site is currently offline, further collection of page content or network traffic would be required to refine the attribution and to identify any post‑compromise activity.