darknetnews[.]com

This domain, darknetnews.com, is currently flagged as an active credential harvesting phishing site targeting unsuspecting users. Analysis indicates the domain is not impersonating a specific brand but instead presents itself as a for-sale landing page, which may serve as a front for malicious redirects or embedded phishing content. The domain remains operational and poses an elevated risk due to its association with known phishing infrastructure. Infrastructure analysis reveals darknetnews.com is registered through TurnCommerce, Inc. DBA NameBright.com and resolves to the IP address 13.223.25.84. It appears on one security blocklist and is flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The domain holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. Detected technologies include CFML, Microsoft ASP.NET, Adobe ColdFusion, and Google Analytics, which may be leveraged to obfuscate malicious activity or track user interactions. Current status confirms the domain remains active, with no evidence of takedown or mitigation. Users and organizations are advised to block traffic to 13.223.25.84 at the network perimeter and add darknetnews.com to enterprise blocklists. Security teams should monitor for connections to this domain in proxy logs, particularly those involving credential submission or redirects. If the domain was previously whitelisted due to its for-sale landing page, it should be immediately reassessed. No legitimate business or user interaction with this domain is recommended until further validation is conducted by threat intelligence providers.