torzon1darknet[.]net

Analysis of torzon1darknet.net indicates a confirmed brand-impersonation phishing domain targeting users of the TorZon darknet market. The domain was registered on November 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. Infrastructure analysis reveals Cloudflare nameservers (demi.ns.cloudflare.com, lars.ns.cloudflare.com) and resolution to IP 104.21.3.153, geolocated to a Cloudflare node in Canada. The site returns an HTTP 200 status and employs HTTP/3, with an SSL certificate issued by Google Trust Services (WE1). The page title, 'TorZon Website | Official TorZon Market Guide, Onion Links,' explicitly claims affiliation with the TorZon brand, aligning with the 'Brand Impersonation' scam type noted in available intelligence. Six security vendors on VirusTotal have flagged the domain, and it appears on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, further supporting its malicious classification. Defenders should treat this domain as high-risk. The use of Cloudflare infrastructure is consistent with threat actors attempting to obscure hosting origins and evade takedowns. No legitimate association with the TorZon market has been verified. Network-level blocking is recommended, along with monitoring for credential harvesting or malware distribution linked to this domain. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, active status, and security vendor detections warrants immediate mitigation.