x[.]wtn-market[.]cc

PhishDestroy identifies wtn-market.cc as a high-risk phishing domain that masquerades as Wethenorth Market, a legitimate Tor-based marketplace, to harvest user credentials and cryptocurrency. The page title 'Wethenorth Market | Official Onion Links & Mirrors' is intentionally misleading, tricking visitors into believing they are accessing the authentic service while directing them to a malicious replica designed for credential theft and financial fraud. This domain is part of an active campaign targeting darknet market users who rely on onion links for anonymity and security. Immediate avoidance is strongly advised to prevent account compromise and financial loss.

This domain was flagged by 6 out of 95 VirusTotal security vendors, indicating widespread detection as malicious. It was registered on July 24, 2025, through DYNADOT LLC and resolves to IP address 104.21.53.13. The site holds a valid SSL certificate issued by Google Trust Services, which threat actors often exploit to lend false legitimacy to their fraudulent pages. Despite the SSL certificate, the domain lacks reputation on established blocklists and maintains low trust scores across threat intelligence platforms, further corroborating its malicious intent.

To mitigate exposure to this threat, users should avoid accessing wtn-market.cc entirely and verify any onion links through official Wethenorth Market channels or trusted community resources. Organizations should block the domain at the network perimeter and update endpoint protections to include the domain and IP address in blocklists. If credentials or cryptocurrency were entered, users must immediately change passwords, revoke API keys, and report the incident to relevant authorities. Proactive monitoring of darknet market discussions can help identify similar campaigns before they gain traction.