wrs24[.]shop

This domain, wrs24.shop, is identified as a fake marketplace phishing site designed to impersonate legitimate online retail platforms. Analysis indicates the site presents itself as "Warriors Market," likely aiming to deceive users into submitting payment details or personal information under false pretenses. The domain is currently offline, though prior activity suggests it was actively used for fraudulent transactions or credential harvesting. Infrastructure analysis reveals the domain was registered on March 24, 2026, through Nicenic International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.25.62, which is proxied through Cloudflare, obscuring the true origin of the malicious infrastructure. VirusTotal reports that 1 of 95 security vendors flagged this domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on one security blocklist and is detected using technologies such as Cloudflare Browser Insights and HTTP/3, which are often leveraged to evade detection and enhance phishing site performance. Given the domain's current offline status, no immediate threat is present; however, historical indicators suggest it may resurface under a different name or infrastructure. Organizations and users are advised to block the domain wrs24.shop and its associated IP 104.21.25.62 at the network level. Security teams should monitor for newly registered domains with similar naming patterns or those using the same registrar. End-users should be educated on recognizing fake marketplace schemes, particularly those mimicking popular brands or using urgent language to prompt transactions.