# PhishDestroy domain threat record: wethenorth.market Content language: English Canonical HTML report: https://phishdestroy.io/domain/wethenorth.market/ Machine-readable companion: https://phishdestroy.io/domain/wethenorth.market/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 15:16:04 UTC - Last availability or vendor check: 2026-10-22 10:36:08 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: TLD Registrar Solutions Ltd. - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 - Registration date (registry RDAP, wethenorth.market): 2026-08-21 16:49:32 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05862-7b35-73dc-b7ce-ea5035032362/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/wethenorth.market - Certificate Transparency search: https://crt.sh/?q=%25.wethenorth.market - Web Archive lookup: https://web.archive.org/web/*/https://wethenorth.market/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview wethenorth.market trades on the name of WeTheNorth, a Canadian darknet marketplace, and presents itself under the title "WeTheNorth Market — Canada Darknet Marketplace Guide 2026". PhishDestroy classifies it as an impersonation phishing page aimed at people searching for the real market's entry point. We first flagged it on 2026-08-31. As of 2026-10-19 the site was still online and serving its content. How the scam works Lookalike "guide" sites for darknet markets rank in search results and promise verified mirror links or onboarding steps. They then route visitors to a login or registration page the operators control. Anyone who signs in there hands over a username, password and sometimes PGP or recovery details, which lets the operators take over the real account. Crypto sent to deposit addresses shown on a copycat page goes straight to the scammers and cannot be reversed. Because the market's users rarely report losses, these clones can stay up and keep collecting for long periods. Evidence On 2026-10-14, 6 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and URLQuery. That is a modest count, but it comes from vendors that do not share a single feed. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers have tracked it independently. Among blocklists, it is currently listed by PhishDestroy. Infrastructure The domain was registered on 2026-08-21 through TLD Registrar Solutions Ltd. We detected it ten days later, a short gap that fits a site built to capture search traffic quickly. It resolves to Cloudflare (AS13335) in the US. That means the visible IP belongs to Cloudflare's shared edge network and does not identify the operators' actual server. What to do If you logged in or registered through this site, assume those credentials are compromised. Change the password and PGP-linked details on the genuine account immediately, and do the same anywhere you reused that password. Treat any crypto you sent to an address shown on this page as lost, and do not send more to "unlock" or "verify" anything. Never reach a marketplace through a search-result guide, and confirm mirror addresses only through signed, trusted sources. Defenders should block the domain at DNS and proxy level, add it to phishing filters, and watch for sibling domains that reuse the WeTheNorth name. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05862-7b35-73dc-b7ce-ea5035032362/ VirusTotal report: https://www.virustotal.com/gui/domain/wethenorth.market Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wethenorth.market Archived copy: https://web.archive.org/web/20260831152939/https://wethenorth.market/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:52:55 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a05862-7b35-73dc-b7ce-ea5035032362.png Captured: 2026-08-31 15:16:04 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05862-7b35-73dc-b7ce-ea5035032362.png Captured: 2026-08-31 15:16:04 UTC Source report: https://urlscan.io/result/01a05862-7b35-73dc-b7ce-ea5035032362/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:25:07Z", "uuid": "01a05862-7b35-73dc-b7ce-ea5035032362", "scanned_at": "2026-08-31T15:14:16Z", "final_url": "https://wethenorth.market/", "status": 200, "ip": "2a06:98c1:3120::3", "domains": [ "fonts.gstatic.com", "cdn.tailwindcss.com", "cdnjs.cloudflare.com", "registry.npmmirror.com", "fonts.googleapis.com" ], "ips": [ "142.251.20.94", "2404:2280:18c:0:3::a", "188.114.96.3", "2606:4700:20::681a:28f", "104.17.25.14", "2a00:1450:4001:c13::5f", "2a06:98c1:3120::3" ], "asns": [ "15169", "24429", "13335" ], "countries": [ "US", "SG", "DE" ], "link_domains": [ "hn2paw7cd6c45lkcxasc2tsq3ijnx5f4v3hjyxemrvgihjtmaadd6ryd.onion" ], "doc_hash": "68997a2af7721113b8de44f4b5af2b80b845f8b18e46c14ffcf1736642fa4a1e", "globals": [ "tailwind", "/template.html", "Vue", "__VUE_HMR_RUNTIME__", "devtoolsFormatters", "__VUE__", "__VUE_DEVTOOLS_HOOK_REPLAY__", "createApp", "ref" ], "tls": { "san": [ "wethenorth.market", "*.wethenorth.market" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "wethenorth.market", "protocol": "TLS 1.3", "valid_to": "2026-11-19T16:56:13Z", "valid_from": "2026-08-21T15:58:33Z" }, "domain_age_days": 1693, "apex_age_days": 1693, "tls_age_days": 9, "tls_valid_days": 90, "requests": 16, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:36:33Z", "uuid": "c43e503c-389d-4f98-828c-458f83487f9c", "scanned_at": "2026-08-31T15:53:06Z", "final_url": "https://wethenorth.market/", "status": 200, "history": [ { "url": "https://wethenorth.market/", "status": 200 } ], "dom_hash": "fdc3373e56cce369b87dd4c883a5ac0f649000bb8981835e05dfa2b484d385eb", "doc_hash": "a3047e198e170cee32be891b27e1a7f634e40991d9c1d693e2482cdb227fdf91", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "wethenorth.market", "type": "A", "value": "104.21.92.216" }, { "name": "wethenorth.market", "type": "A", "value": "172.67.198.219" }, { "name": "wethenorth.market", "type": "AAAA", "value": "2606:4700:3031::ac43:c6db" }, { "name": "wethenorth.market", "type": "AAAA", "value": "2606:4700:3033::6815:5cd8" } ], "dnssec_valid": false, "ip": "104.21.92.216", "whois": { "registrar": "TLD Registrar Solutions Ltd.", "created": "2026-08-21T16:49:32Z", "updated": "2026-08-26T16:50:13Z", "expires": "2027-08-21T16:49:32Z", "nameservers": [ "lars.ns.cloudflare.com", "demi.ns.cloudflare.com" ] } } } ```