Analysis of the domain darkmatter-info.digital indicates active phishing infrastructure targeting corporate users. Registered on July 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains operational as of July 28, 2026. It resolves to IP address 188.114.97.3 and uses Cloudflare nameservers (adel.ns.cloudflare.com, javon.ns.cloudflare.com), a common configuration for phishing sites seeking to obscure hosting origins and evade takedowns.
The domain appears on one security blocklist and is blocked by PhishDestroy, while VirusTotal shows a single detection from 91 vendors, suggesting limited but existing recognition as malicious. No brand target or specific phishing kit has been confirmed in available data, and the exact content of the site is not yet analyzed. The domain's recent creation and Cloudflare hosting are consistent with short-lived phishing campaigns.
Defenders should treat this domain as high-risk and prioritize blocking it at DNS and web gateway levels. Monitoring for associated IP addresses and registrar patterns may help identify related infrastructure. Given the lack of widespread detection, automated alerts from security vendors may not yet be comprehensive, and manual verification of related domains is recommended.