darkwiki[.]ink

This domain, darkwiki.ink, is flagged as a credential theft operation designed to impersonate legitimate darknet encyclopedia resources. Analysis indicates the site presents itself as "DarkWiki 2026 | Complete Darknet Encyclopedia & History," a fabricated brand intended to deceive users into entering login credentials or other sensitive information. No direct evidence of a crypto drainer kit or wallet interception scripts was observed, but the infrastructure aligns with credential harvesting tactics commonly used in phishing campaigns targeting darknet communities. The site does not appear to be a direct replica of an existing brand but instead leverages the allure of darknet knowledge repositories to build false trust. Infrastructure analysis reveals the domain resolves to IP address 45.155.54.117 and was registered through NiceNIC International Group Co., Limited on February 21, 2026. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The site was hosted on an Ubuntu server running Nginx, a configuration consistent with low-cost, high-volume phishing infrastructure. No Google Safe Browsing (GSB) flags were observed at the time of analysis, though this may reflect a lag in GSB’s detection pipeline rather than an absence of malicious activity. As of the latest assessment, darkwiki.ink has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the risk of resurgence remains elevated given the domain’s recent creation date and the persistent demand for darknet-related phishing lures. Users who may have interacted with the site are advised to rotate credentials for any accounts accessed during the exposure window, particularly those tied to darknet forums or cryptocurrency services. Network defenders should monitor for DNS requests to 45.155.54.117 and implement blocklist updates to prevent access if the domain reactivates. The registrar, NiceNIC International Group Co., Limited, has been associated with other high-risk domains, warranting continued scrutiny of newly registered domains under its management.