torzon-link[.]xyz

PhishDestroy identifies torzon-link.xyz as a confirmed phishing domain designed to impersonate the Torzon Market darknet marketplace. The site is currently offline, but while active, it aimed to deceive users by presenting itself as an official access guide for Torzon Market, likely to harvest login credentials or cryptocurrency payments. This specific threat type, classified as generic phishing, poses an elevated risk due to its targeted impersonation of a known brand.

Technical analysis reveals that the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to IP address 45.147.197.100. Security scans on VirusTotal show that 2 out of 95 vendors flagged the domain as malicious, and it appears on one security blocklist. The SSL certificate was issued by Let's Encrypt (R13), which is common for phishing sites due to its free and automated issuance. Additionally, AlienVault OTX includes this domain in one threat intelligence pulse, indicating community awareness of its malicious nature.

Given its current offline status, the immediate risk is reduced, but users should remain vigilant as similar domains may emerge. PhishDestroy strongly advises against visiting or interacting with any Torzon Market-related links from unverified sources. Always verify official URLs through trusted communities or official channels. If you have already entered credentials or made payments on this site, change your passwords immediately and monitor accounts for suspicious activity. Report any new suspicious domains to PhishDestroy for further analysis.