dark-web[.]guru

The domain dark-web.guru was registered on May 15 2026 by NICENIC INTERNATIONAL GROUP CO., LIMITED. Its public-facing page presents the title “DarknetHub - Best Darknet Marketplace Aggregator”, suggesting an attempt to masquerade as a legitimate darknet marketplace index. HTTP responses return status 200, indicating the site is actively serving content. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.67.202.145, with both authoritative name servers listed as marlowe.ns.cloudflare.com and hasslo.ns.cloudflare.com. The hosting network is located in Canada and the TLS certificate is issued by Google Trust Services under the WE1 profile, providing a valid HTTPS connection that may lend credibility to unsuspecting visitors. Threat intelligence sources have flagged the domain. It appears on a single security blocklist and is referenced in one AlienVault OTX pulse. PhishDestroy has already blocked the site, and the risk level is currently marked as under_investigation while the status remains active. The Gridinsoft trust score of 0 out of 100 reflects a low reputation score, and no detections were reported by VirusTotal at the time of analysis. Uncertainty remains regarding the operators behind the site and the specific payloads or credential harvesting mechanisms employed, as no malware samples or phishing templates have been disclosed. Defenders should add dark-web.guru to outbound filtering rules, monitor DNS queries for the associated Cloudflare name servers, and consider sinkholing the IP address to disrupt traffic. Continuous re‑evaluation of blocklist status and TLS certificate changes is recommended to keep mitigation measures aligned with any evolution of the campaign.