darknetbible[.]info

This domain, darknetbible.info, is flagged as a high-risk generic phishing portal targeting cryptocurrency users. Analysis indicates the site masquerades as a darknet marketplace (DNM) resource, using the page title 'Introduction | DNM Bible' to lend credibility. While no specific drainer kit has been conclusively identified, the domain’s structure and content align with known cryptocurrency phishing campaigns designed to harvest wallet credentials or distribute malicious payloads. The use of darknet-themed branding suggests an intent to exploit users seeking anonymized financial services, a common tactic in cryptocurrency-focused phishing operations. Infrastructure analysis reveals the domain was registered on May 01, 2022, through PDR Ltd. d/b/a PublicDomainRegistry.com. It currently resolves to the IP address 186.2.175.41, hosted on AS59692 (IQWeb FZ-LLC) in Belize. Despite its active status, the domain has evaded widespread detection, with a VirusTotal score of 0/95 detections as of the latest scan. However, it appears on three security blocklists and is proactively blocked by multiple threat intelligence feeds. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious domains due to its accessibility and automation. The domain remains active, posing an ongoing risk to users who may encounter it through search engines, forums, or social engineering vectors. Response actions by security providers, including preemptive blocking, have mitigated but not eliminated the threat. Users are advised to treat this domain as malicious and avoid interaction, particularly those involved in cryptocurrency transactions. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for related infrastructure that may emerge under the same registrar or hosting provider.