darkmattermarket[.]onl

This domain presents an elevated risk as a credential theft phishing site, specifically impersonating a dark web marketplace called 'Dark Matter' to harvest user login credentials. The page title 'Account - Signin | Dark Matter' clearly indicates an attempt to trick users into entering their account details, making this a classic brand impersonation and credential theft operation.

PhishDestroy identified this domain through multiple threat intelligence sources. AlienVault OTX included it in one threat pulse, and it appears on one security blocklist. VirusTotal flagged it with 1 out of 95 security vendors marking it malicious. The domain resolves to IP address 172.67.154.126, was registered through Dynadot Inc on May 15, 2026, and uses an SSL certificate from Google Trust Services (WE1). Although now taken offline, its short lifespan and low trust scores indicate a purpose-built phishing campaign.

Users who may have interacted with this domain should immediately change passwords for any accounts used on the fake Dark Matter site and enable multi-factor authentication where available. Monitor financial accounts for unauthorized transactions and report any suspicious activity to relevant authorities. Avoid entering credentials on sites accessed through unsolicited links or with unusual domain extensions like '.onl'.