darknetindex[.]com

darknetindex.com is a newly registered domain created on June 8, 2026 and currently resolves to the IPv4 address 103.75.119.194. The host is operated by Oneprovider.com in Australia and the web server identifies itself as Apache HTTP Server. The site presents a valid Let’s Encrypt certificate (issuer E8) and returns HTTP status 200 for the landing page titled “Darknet Index | darknet news, links and more”. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently used for short‑lived domains in malicious campaigns.

Multiple threat intelligence sources flag the domain as a generic phishing site. Five separate AlienVault OTX pulses reference darknetindex.com, and PhishDestroy has already added it to its blocklist. VirusTotal analysis shows that six out of ninety‑five security vendors have reported it as malicious, indicating a modest but consistent detection rate. The domain also appears on an additional security blocklist, reinforcing its reputation for abuse.

Infrastructure analysis reveals a simple hosting setup: the IP address 103.75.119.194 is associated exclusively with a single Apache instance, and no CDN or proxy services are observed. The Let’s Encrypt certificate is recent, aligning with the June registration date, suggesting the operators obtained a legitimate TLS certificate to increase credibility. No further subdomains or related hostnames were discovered in public DNS records.

Current uncertainties include the specific content delivered to victims and whether the site employs credential‑stealing forms or redirects to secondary payload hosts. Defenders should proactively block traffic to darknetindex.com and its resolved IP, monitor for any outbound connections to the IP range, and incorporate the domain into email and web filtering policies. Continuous re‑evaluation is advised, as the site remains active and may evolve its phishing tactics.