kerberos-darknet[.]org

This domain, kerberos-darknet.org, is actively serving a phishing site targeting users seeking access to darknet markets. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to IP 104.21.34.18, hosted on Cloudflare's infrastructure (AS13335). The page title, 'Kerberos Darknet Market Link - Official Verified Onion Mirrors,' explicitly suggests an attempt to deceive users into believing they are accessing legitimate darknet market mirrors. Analysis indicates the domain is flagged by at least one security blocklist, and PhishDestroy has blocked it. Two of 93 security vendors on VirusTotal have detected the domain as malicious, though the specific nature of the threat remains unverified beyond its phishing classification.

Infrastructure analysis reveals the use of Cloudflare nameservers (katelyn.ns.cloudflare.com, nico.ns.cloudflare.com) and technologies including HSTS, Cloudflare Browser Insights, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare. The HTTP status returns 200, confirming the site is operational as of the report date. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. Defenders should treat this domain as an active phishing threat.

Block access at the DNS or network level, and monitor for related domains using similar naming conventions or infrastructure. The lack of widespread detection on VirusTotal does not indicate safety; only two vendors have flagged it, suggesting the threat may still be emerging or evading broader detection. No evidence links this domain to a specific phishing kit or brand beyond the darknet market pretext.