mega-market-onion[.]cc

PhishDestroy identifies mega-market-onion.cc as a phishing website impersonating dark web marketplaces, specifically targeting users seeking illicit goods or services. This domain is part of a sophisticated campaign designed to deceive visitors into believing they are accessing a legitimate underground marketplace. The site likely harvests credentials, crypto wallet details, or other sensitive data under the guise of a transactional portal. Given the domain's recent creation and lack of detections, it poses a high risk to unsuspecting users who may be drawn to its perceived anonymity. This domain was flagged with the following technical indicators: registered on January 12, 2023, resolving to IP 104.21.73.115, and leveraging an SSL certificate issued by Google Trust Services to appear legitimate. VirusTotal currently shows 12/95 detections, indicating it has evaded initial antivirus and security tool scrutiny. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for both legitimate and malicious use cases, further complicating attribution. The absence of blocklist entries suggests this threat is still emerging but should not be underestimated due to its targeted nature. Users who visited mega-market-onion.cc should assume their data was compromised and take immediate action. Disconnect any devices used to access the site from networks, scan them with updated antivirus software, and revoke any credentials entered into forms on the page. Consider reporting the incident to relevant authorities, such as local cybercrime units or platforms like Have I Been Pwned. Monitor financial accounts for unauthorized transactions and enable two-factor authentication on all critical services. Avoid interacting with similar domains, as this campaign may expand to other superficially similar URLs.