darkseller[.]cc

The domain darkseller.cc was registered through Dynadot Inc on July 01, 2024 and continues to resolve to the IP address 104.21.83.200, which belongs to Cloudflare’s content‑delivery network. The authoritative nameservers listed for the zone are gabriel.ns.cloudflare.com and princess.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Current intelligence classifies the site as a generic phishing operation; the classification is based on observed activity patterns rather than on any publicly disclosed page content, which has not been analyzed. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one anti‑phishing feed has identified malicious intent.

VirusTotal records show that the domain has been scanned by 91 independent security vendors; none have raised a detection at the time of analysis. While the absence of vendor detections does not constitute a safety guarantee, it demonstrates that the indicator has not yet triggered automated signatures in those engines. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) reports are presently associated with the domain. Consequently, the observable evidence consists primarily of registration details, hosting configuration, and the single blocklist entry.

Uncertainty remains regarding the specific payload, credential‑harvesting mechanisms, or targeted brands, as no page title, SSL certificate analysis, or HTTP response data have been disclosed. Defenders should consider adding darkseller.cc to internal deny‑list rules, monitoring DNS queries for the associated Cloudflare IP, and employing request‑level inspection for traffic directed to the domain. Continuous re‑evaluation is advised, given the active status and the potential for future detection updates from scanning services or blocklist providers.