wtn-darknet[.]biz

Analysis of wtn-darknet.biz shows an active malicious infrastructure used for phishing. The domain resolves to the IPv4 address 81.91.178.50, which is registered to Peetinvest B.V in the Netherlands. The hosting uses a Let’s Encrypt certificate (R12) and serves HTTP 200 responses. The page title returned by the web server is "WeTheNorth Market – Official Mirrors", indicating a likely attempt to impersonate a market platform. Server‑side technologies identified are PHP and DDoS‑Guard, a common combination for low‑cost phishing sites. The domain was registered on 26 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is managed by the nameservers ns3.zomro.su, ns1.zomro.net, and ns2.zomro.com. Reputation scoring from Gridinsoft is 0/100, and five of ninety‑four VirusTotal scanners flag the host as malicious. The site is currently listed on one external blocklist and has been blocked by the PhishDestroy mitigation service. Although the exact phishing payload has not been captured, the combination of a recent registration, low trust scores, and detection by multiple security vendors strongly suggests a high‑risk phishing operation. Defenders should block the domain and its associated IP at perimeter firewalls, add the nameservers to DNS‑sinkhole lists, and monitor for any outbound connections to the host. Ongoing observation is recommended to capture any changes to the page content or additional infrastructure components.