abacusdarknet[.]org

Analysis of the domain abacusdarknet.org indicates it is an active phishing site targeting users of the Abacus Market, a darknet marketplace. The domain was registered on May 19, 2026, through Eranet International Limited and currently resolves to the IP address 104.21.56.205, hosted by Cloudflare in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (pete.ns.cloudflare.com and walk.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are common among both legitimate and malicious sites. The domain returns an HTTP 301 redirect status, suggesting it may forward visitors to another location, though the final destination remains unconfirmed. The page title, 'Abacus Market URL 2025 - Official Abacus Links,' explicitly claims affiliation with the Abacus Market, a known darknet brand, aligning with the scam type classified as brand impersonation. As of July 12, 2026, the domain appears on one security blocklist and has been included in one threat intelligence pulse on AlienVault OTX. No detections were reported by the 92 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm safety. The domain remains active and is currently blocked by at least one security provider. Defenders should treat this domain as high-risk due to its association with brand impersonation and its presence on security blocklists. Network-level blocking of the IP 104.21.56.205 and monitoring for connections to the domain are recommended. Further investigation is needed to determine the final landing page, any associated credential harvesting mechanisms, or additional infrastructure linked to this campaign. The domain's recent registration and use of Cloudflare infrastructure warrant continued scrutiny, as these characteristics are frequently observed in phishing operations.