market[.]torzontor[.]link

market.torzontor.link was observed hosting a page titled “Torzon Darknet Market - Official Link & Secure Access”. The domain was registered on 23 February 2026 through NameSilo, LLC and is served from Cloudflare’s network (AS13335) at IP 188.114.96.3, located in the United States. The authoritative nameservers are miles.ns.cloudflare.com and mona.ns.cloudflare.com, and the site does not present an SSL certificate, indicating that HTTPS was not enforced when the page was reachable. The domain appears on a single security blocklist and is specifically listed by PhishDestroy, suggesting that at least one anti‑phishing feed has identified it as malicious. VirusTotal analysis shows that two of ninety‑three scanned security vendors flagged the domain, providing independent confirmation of suspicious behavior.

As of the reporting date the site is taken offline, and no active HTTP response could be retrieved for further content inspection. The available evidence points to a typical phishing infrastructure: a freshly registered domain, rapid deployment behind Cloudflare’s CDN to obscure origin, and immediate inclusion on a phishing‑focused blocklist. However, the lack of an SSL certificate and the offline status limit the ability to confirm the exact phishing payload or targeted brand. No Safe Browsing, OTX, or additional reputation data are currently available, and the page content has not been captured for deeper analysis. Defenders should continue to monitor the domain’s resolution and blocklist status.

Adding the domain and its IP address (188.114.96.3) to network‑level deny lists will prevent accidental connections. Because the domain leverages Cloudflare, future re‑hosting under a different sub‑domain is possible; security teams should watch for similar naming patterns (e.g., “torzon” or “torzontor”) and for new registrations through the same registrar. Regular re‑query of VirusTotal and other multi‑engine scanners is advised to capture any emerging detections.