marketplace-darkmatter[.]com

Analysis of marketplace-darkmatter.com shows an active infrastructure designed to impersonate a darknet marketplace brand. The domain was registered on May 04, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare, resolving to IP 172.67.206.58, which is located in Canada. Cloudflare services are confirmed by the presence of Cloudflare Browser Insights and the use of HTTP/3. The site serves content over HTTPS with a Let’s Encrypt certificate (E8). A single VirusTotal vendor flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. The page title, "DarkMatter Market Link | Official Darknet Onion URL 2026," suggests the site is attempting to lure victims seeking a darknet market, consistent with the recorded scam type of brand impersonation. The domain is currently listed on one security blocklist and has been blocked by PhishDestroy, yet it continues to return HTTP 200 responses, confirming it is still operational. Nameservers autumn.ns.cloudflare.com and rory.ns.cloudflare.com are actively resolving the domain. Defenders should prioritize immediate blocking of marketplace-darkmatter.com at perimeter defenses and update any URL filtering feeds to include this indicator. Continuous monitoring of Cloudflare‑associated IP ranges for similar brand‑impersonation patterns is advised, as the use of shared infrastructure can facilitate rapid re‑deployment of malicious sites. Given the limited public intelligence beyond the observed infrastructure, further analysis of the site’s content and any payloads it may deliver is recommended to refine detection rules and assess potential victim impact.