darkmatter-market[.]cyou

This domain, darkmatter-market.cyou, is under investigation as a generic phishing threat as of July 28, 2026. It was created on July 25, 2026, and remains active. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar sometimes associated with high-risk or disposable domains. Its nameservers are adel.ns.cloudflare.com and javon.ns.cloudflare.com, and it resolves to the IP address 188.114.97.3, which is part of Cloudflare's hosting infrastructure.

VirusTotal scans from 91 vendors show zero detections, though an absence of detections does not confirm the domain is safe; it may simply indicate the threat is recent or not widely recognized. The domain appears on one security blocklist and is specifically blocked by PhishDestroy, a community-driven blocklist, lending credibility to the phishing classification. No additional page content, brand target, or scam type has been analyzed, so the exact nature of the phishing lure remains unknown. The domain's creation less than a week before the report date, combined with its appearance on a blocklist, suggests it may be used for credential harvesting or other deceptive campaigns.

Defenders should treat this domain as suspicious, monitor for any associated email traffic or login page captures, and block it at the network or email gateway level pending further investigation. Users who encounter this domain should avoid interacting with it and report it to relevant security teams. Continued monitoring for changes in DNS records, SSL certificate issuance, or new blocklist entries is recommended to assess evolving risk.