darkmatter[.]cfd

Analysis of darkmatter.cfd indicates an active high‑risk phishing infrastructure. The domain was registered on June 12 2026 through Dynadot Inc and resolves to the IPv4 address 45.147.197.100, which is hosted in the Netherlands under the Podaon SIA organization. The site serves content over HTTPS using a Let’s Encrypt (R12) certificate and returns HTTP 200 responses. The page title retrieved is “Dark Matter Market Link”, but no further content has been examined. Service fingerprints show PHP and DDoS‑Guard components, suggesting a typical web‑hosting stack. Reputation data show five of ninety‑one VirusTotal scanners flag the domain, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single public blocklist. It is also listed in four AlienVault OTX pulses and has been blocked by the PhishDestroy feed. Nameservers are ns1.zomro.net, ns2.zomro.ru, ns3.zomro.com, and ns4.zomro.su. The evidence collectively supports the classification of the domain as a generic phishing site. Defenders should consider immediate blocking of the domain and its associated IP address, inclusion in internal threat‑intel feeds, and continued monitoring for any changes in hosting or content. Because the page content has not been publicly dissected, additional analysis is advised to confirm the specific lure used.