dark-matter-darknet[.]sbs

This domain, dark-matter-darknet.sbs, is identified as a credential theft portal designed to impersonate the Dark Matter Market, a known darknet marketplace. The page title, "Dark Matter Market Link 2026 - Official Verified," explicitly attempts to deceive users into believing they are accessing a legitimate and verified marketplace link. Analysis indicates no direct evidence of a crypto drainer kit, but the infrastructure and branding suggest a focus on harvesting login credentials, payment details, or other sensitive user data under false pretenses. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 45.147.197.100 and was registered through DYNADOT LLC on June 12, 2026. Security vendors on VirusTotal flagged the domain with a score of 7/95, while Gridinsoft assigned a trust score of 0/100. The domain appears in four threat intelligence pulses on AlienVault OTX and is listed on one security blocklist. It employs a Let's Encrypt SSL certificate and utilizes PHP alongside DDoS-Guard for hosting, which is often associated with bulletproof infrastructure. Google Safe Browsing (GSB) does not currently list the domain, but the combination of low trust scores and blocklist presence underscores its elevated risk profile. As of the latest assessment, dark-matter-darknet.sbs has been marked as taken down, likely due to enforcement actions by security providers such as PhishDestroy. However, residual risk remains for users who may have interacted with the domain prior to its removal. Organizations and individuals are advised to monitor for unauthorized access attempts, reset credentials associated with any accounts exposed to this domain, and implement multi-factor authentication where possible. Network administrators should block the IP address 45.147.197.100 and monitor for related infrastructure, as threat actors may pivot to new domains or IPs to resume operations.