rot[.]taxi

This domain is flagged under investigation for credential theft phishing targeting users seeking darknet access. The site presents itself as a gateway service with the page title 'tor.taxi - your ride to the darknet,' a clear social engineering lure designed to harvest login credentials or payment details from individuals attempting to access restricted networks. Analysis indicates the domain rot.taxi was registered on June 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to the IP address 188.114.96.3 and remains active. VirusTotal reports 0/95 detections, suggesting the infrastructure has not yet been widely flagged by security vendors. No entries were found on major blocklists, and trust scores remain neutral due to limited visibility. The domain's recent creation and lack of prior reputation increase the likelihood of malicious intent. Mitigation steps specific to this threat type include immediate blocking of the domain and IP at the network perimeter. Security teams should monitor for connections to 188.114.96.3 and inspect logs for outbound requests to rot.taxi. End-user education should emphasize the risks of darknet-themed services, particularly those soliciting credentials or financial information. If credentials were entered, affected accounts must be rotated, and multi-factor authentication enabled where possible. Network traffic analysis should prioritize identifying compromised hosts that interacted with this infrastructure.