vortex-darknet[.]net

The domain vortex-darknet.net was registered on February 21, 2026 and currently resolves to IP 81.91.178.50, hosted in the Netherlands under AS204601 (NovoServe B.V.). The authoritative name servers are ns1.zomro.net, ns2.zomro.com, and ns3.zomro.su. An HTTP request returns status code 200 and the page title "Vortex Market 2026 — Verified Onion Links & Secure Trading". Technology fingerprints indicate the presence of PHP and DDoS-Guard, and the site uses a Let’s Encrypt R12 certificate. Security telemetry shows a Gridinsoft trust score of 0/100, the domain is listed on one external blocklist, and PhishDestroy has already blocked it. VirusTotal analysis recorded a single positive detection out of 93 scanning engines. The threat is classified as generic_phishing with a high risk rating and remains active. While the page title suggests the site purports to provide verified onion links for illicit trading, no additional content has been examined, and the specific phishing payload or credential‑harvesting mechanisms are not yet confirmed. Defenders should add vortex-darknet.net and its resolving IP address to network deny lists, monitor for DNS queries or outbound connections to the host, and consider broader threat‑intel sharing to alert peers of this emerging phishing infrastructure.