darktorlist[.]com

This domain is identified as a credential theft phishing vector presenting as a directory of darknet market onion links and reviews. Analysis indicates the site may be used to lure users searching for illicit marketplaces, potentially embedding malicious redirects or prompts designed to capture sensitive credentials or facilitate further compromise. No explicit brand impersonation is observed, but the thematic lure targets high-risk user intent.

Technical indicators show the domain has a VirusTotal detection rate of 1/95 and is registered through Shinjiru Technology Sdn Bhd. It was created on May 19, 2026 and resolves to IP address 104.21.39.20, hosted within infrastructure associated with Cloudflare, Inc. The site is currently active and appears on 1 security blocklist, indicating limited but present detection coverage.

Despite the low detection ratio, the domain remains active and accessible, sustaining exposure risk. Users who accessed this resource should avoid entering credentials, clear browser data, and monitor for suspicious account activity. Network defenders should implement blocking controls and continue monitoring for related infrastructure, as low detection counts may indicate emerging or evolving phishing operations.