darkmatter-darknet-shop[.]com

Analysis indicates that the domain darkmatter-darknet-shop.com was registered on 23 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers are aspen.ns.cloudflare.com and gerardo.ns.cloudflare.com, pointing the domain to Cloudflare’s network (ASN 13335) with the address 188.114.96.3 located in the United States. The site served a HTTP 503 response and presented a page title referencing a “DarkMatter Darknet Shop” and a “Verified DarkMatter Darkweb URL”, suggesting an attempt to masquerade as a legitimate DarkMatter marketplace. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid, publicly trusted certificate.

Infrastructure fingerprints show the presence of Tailwind CSS, Flowbite, jsDelivr and HTTP/3, all typical of modern web stacks but offering no indication of malicious payloads. The domain’s Gridinsoft trust score is 0 out of 100, and it appears on a single security blocklist. VirusTotal scans report three detections out of ninety‑three scanners, and PhishDestroy has already blocked the domain, confirming a phishing classification.

Uncertainty remains regarding the exact content served before the site was taken offline; no sandbox or content analysis is available. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any future reuse, and add the domain to local allow‑list exceptions only after thorough verification. Ongoing watch‑lists such as PhishDestroy and VirusTotal should be consulted for any new detections, and any inbound traffic claiming to be a DarkMatter marketplace should be treated as suspicious.