wtn-market[.]pro

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to impersonate a verified darknet market. Analysis indicates the domain targets users seeking illicit or restricted services, likely to harvest credentials, payment details, or distribute malware under the guise of a legitimate marketplace. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 172.67.165.220 and was registered through NiceNIC International Group Co., Limited on February 21, 2026. VirusTotal detection shows 6 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, and the SSL certificate is issued by Google Trust Services. Detected technologies include Tailwind CSS, Cloudflare, and HTTP/3, suggesting a modern, obfuscated infrastructure. Mitigation steps for this threat type include blocking the domain and its resolving IP at the network perimeter. Security teams should monitor for connections to 172.67.165.220 and inspect SSL certificates issued by Google Trust Services for similar patterns. Endpoint protection should be configured to detect and prevent access to phishing domains impersonating darknet markets. User awareness training should emphasize the risks of interacting with unverified marketplaces, particularly those using terms like 'verified onion market' in page titles.