3mir[.]org

The domain 3mir.org has been identified as a generic phishing site specifically designed to impersonate the Zeleniy Mir rasta marketplace, a known darknet-style platform. This phishing operation is currently offline, having been taken down after security researchers flagged its malicious activities. The site posed as a legitimate link to the marketplace, likely aiming to harvest credentials or drain cryptocurrency wallets from unsuspecting users.

Registered through Cloudflare, Inc. on September 30, 2025, the domain resolves to IP address 172.67.217.155. It appears on one security blocklist and has been flagged by 2 out of 95 VirusTotal vendors, indicating a moderate but confirmed threat. The SSL certificate is issued by Google Trust Services under WE1, which is common for legitimate sites but also abused by phishers. The page title explicitly references Zeleniy Mir, confirming the brand impersonation.

Given that the site has been taken offline, the immediate risk is low, but users should remain vigilant as similar domains may appear. PhishDestroy recommends avoiding any links purporting to be from Zeleniy Mir or similar marketplaces, and to verify URLs directly through official channels. If you have interacted with this domain, change your passwords and monitor your accounts for unauthorized activity.