kerberosaccess[.]com

kerberosaccess.com was observed on July 12, 2026 with an HTTP 200 response and a page title reading “Kerberos Market - Access Trusted Darknet Marketplace.” The site is currently classified as a generic phishing resource and remains active under investigation.

The domain was registered on May 19, 2026 through Spaceship, Inc. and is hosted on Cloudflare infrastructure, resolving to IP address 188.114.96.3 located in Canada. Authoritative nameservers are elle.ns.cloudflare.com and vicky.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 identifier, while the Gridinsoft trust score is 0 out of 100, indicating no observed reputation.

Open Threat Exchange (OTX) listed the domain in a single intelligence pulse, and PhishDestroy has already added it to its blocklist. The domain appears on one additional security blocklist, reinforcing the consensus that the site is malicious. No detections were recorded on VirusTotal at the time of analysis, but the lack of detections does not imply safety.

Defenders should block any outbound connections to 188.114.96.3 and add kerberosaccess.com to domain deny lists. Continuous monitoring of DNS queries for this domain is recommended, and any credential submissions to the site should be treated as compromised. Incident response teams should capture network traffic for further payload analysis and consider threat hunting for related indicators tied to the Cloudflare nameservers.

Further investigation is required to determine the exact phishing campaign vector and any associated credential harvesting mechanisms. Analysts should request a full page content snapshot from the URL and compare it against known phishing kits. Correlation with other domains using the same Cloudflare nameservers may reveal additional infrastructure.