# krmdarknet.com — SUSPICIOUS

> krmdarknet.com is a phishing domain resolving to 172.67.137.36, posing as a fake Darknet marketplace. Blocked by SEAL and MetaMask, it was flagged by 2/95.

## Summary
Is krmdarknet.com Safe? A Risk Assessment by SOC Analysts

At an elevated risk level, krmdarknet.com is identified as a generic phishing domain actively exploiting user trust through deceptive branding. The threat involves credential harvesting and potential malware distribution under the guise of a Darknet marketplace, luring users seeking illicit goods or services. This domain has already been flagged by security vendors, indicating active reconnaissance by threat actors targeting unsuspecting visitors. Users interacting with this domain risk exposing sensitive data, financial loss, or device compromise.

PhishDestroy identifies krmdarknet.com as a high-confidence phishing domain, with multiple technical indicators confirming its malicious nature. The domain resolves to IP 172.67.137.36 and is blocked on two security blocklists, including SEAL and MetaMask. VirusTotal analysis reveals 2 out of 95 security vendors have flagged this domain as malicious. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on August 28, 2025, the domain leverages a Google Trust Services SSL certificate to appear legitimate. Despite this, the mismatch between its recent creation date and the fabricated trust score (as evidenced by the low detection rate on VirusTotal) highlights its deceptive nature.

Mitigation for this phishing threat requires immediate action from both users and organizations. Users should avoid visiting krmdarknet.com entirely and report the domain to their security teams or browser vendors if encountered. Organizations should ensure their DNS and web filtering solutions block this domain based on its IP, SSL fingerprint, and domain characteristics. Additionally, security teams should scan for internal exposure to this domain, particularly in DNS logs or proxy traffic, and update threat intelligence feeds to include krmdarknet.com and its associated infrastructure. Proactive user awareness training on identifying phishing domains—such as scrutinizing recently registered domains with high SSL trust scores—is critical to reducing the risk of exploitation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-08-28 19:53:41
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.137.36

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["SEAL", "MetaMask"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/765dfa15-1902-4f95-a0f9-9d36523da4d5
- PhishDestroy: https://phishdestroy.io/domain/krmdarknet.com/
- LLM endpoint: https://phishdestroy.io/domain/krmdarknet.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/krmdarknet.com/
Last updated: 2026-03-22