blackopsmarketurl[.]digital

This domain, blackopsmarketurl.digital, is flagged as an active phishing site targeting users seeking darknet market access. Analysis indicates the domain was registered on February 22, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP 172.67.188.109, hosted on Cloudflare's infrastructure (AS13335). The page title, 'BlackOps Market URL - Official Darknet Access,' suggests an attempt to deceive users into believing this is a legitimate entry point for darknet services. The domain is blocked by one security vendor (PhishDestroy) and is flagged by 3 of 95 security vendors on VirusTotal, indicating moderate detection but not yet widespread recognition as malicious. Infrastructure analysis reveals the use of Cloudflare nameservers (kami.ns.cloudflare.com, clay.ns.cloudflare.com) and HTTP/3, which may complicate takedown efforts or attribution.

The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging Cloudflare. The HTTP status code 200 confirms the site is currently active and serving content. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. Defenders should treat this domain as a confirmed phishing threat.

Block access at the network level using the domain and associated IP (172.67.188.109). Monitor for related domains registered through the same registrar or resolving to the same IP, as this may indicate a broader campaign. Given the domain's age (5 months) and continued activity, it is likely part of an ongoing operation rather than a short-lived scam. No evidence of a specific phishing kit or brand impersonation beyond the darknet market theme is present in the available data, so further analysis of the site's content is recommended if additional context is required.