# PhishDestroy domain threat record: tordaily.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/tordaily.com/ Machine-readable companion: https://phishdestroy.io/domain/tordaily.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 15:15:42 UTC - Last availability or vendor check: 2026-10-22 10:36:43 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: dhl ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: DNS Africa Ltd - Registrar country in stored WHOIS data: ZA - Last stored HTTP status: 200 - Registration date (registry RDAP, tordaily.com): 2025-05-11 14:51:37 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05862-7b12-7364-854a-d726eb5d8c4e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/tordaily.com - Certificate Transparency search: https://crt.sh/?q=%25.tordaily.com - Web Archive lookup: https://web.archive.org/web/*/https://tordaily.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview tordaily.com presents itself as a Tor link guide under the heading "WetheNorth Market – Tor Daily". It uses the WeTheNorth Market name to draw in people searching for that market's access points. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-08-31. On 2026-10-19 the domain was still resolving and serving live content. How the scam works Sites like this rank for searches such as a market's name plus "link" or "mirror" and promise a verified way in. The visitor is sent to a lookalike login or deposit page that the operators control. Anything entered there can be captured, including usernames, passwords and account recovery details. If the clone also shows a wallet address for deposits, any cryptocurrency sent goes straight to the scammers and cannot be recovered. Because it borrows a familiar brand and a neutral "daily" news framing, the page looks like a reference resource rather than a trap. Evidence Independent detection is still thin. On 2026-10-14, 5 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. Most engines therefore still let it through, which is why a visitor's browser or antivirus may not warn them. The domain also appears in 5 AlienVault OTX threat pulses, so other researchers are tracking it too. Of the major blocklists, only PhishDestroy currently lists it. Infrastructure The domain was registered on 2025-05-11 through DNS Africa Ltd, more than fifteen months before PhishDestroy detected it. That long, quiet lifespan fits a site built to collect search traffic over time rather than a short burst campaign. It sits behind Cloudflare (AS13335) on a US-based address, so the real origin server is hidden from view. What to do If you entered a username or password on this site, change it at once on the genuine service and anywhere else you reused it. Turn on two-factor authentication, and treat any recovery phrases or PGP-related details you typed there as exposed. Do not send funds to any address this site displays. Crypto that has already been transferred cannot be reversed, so stop further payments and keep a record of the transaction details. Security teams should block tordaily.com at DNS and proxy level and add it to their phishing feeds, given how few engines catch it today. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05862-7b12-7364-854a-d726eb5d8c4e/ VirusTotal report: https://www.virustotal.com/gui/domain/tordaily.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tordaily.com Archived copy: https://web.archive.org/web/20260831151807/https://tordaily.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:52:57 UTC ## Stored page captures - Primary capture: https://i.ibb.co/93zSPjbr/960823c04b63.png Captured: 2026-08-31 15:15:42 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05862-7b12-7364-854a-d726eb5d8c4e.png Captured: 2026-08-31 15:15:42 UTC Source report: https://urlscan.io/result/01a05862-7b12-7364-854a-d726eb5d8c4e/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:25:10Z", "uuid": "01a05862-7b12-7364-854a-d726eb5d8c4e", "scanned_at": "2026-08-31T15:14:11Z", "final_url": "https://tordaily.com/wethenorth-market/", "status": 200, "redirects": [ { "to": "https://tordaily.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f", "from": "https://tordaily.com/wethenorth-market/" }, { "to": "https://tordaily.com/wethenorth-market/", "from": "https://tordaily.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f", "status": 302 } ], "ip": "188.114.96.3", "domains": [ "s.w.org" ], "ips": [ "192.0.77.48", "188.114.96.3" ], "asns": [ "2635", "13335" ], "countries": [ "US" ], "link_domains": [ "www.youtube.com", "www.bitchute.com", "hn2paw7zaahbikbejiv6h22zwtijlam65y2c77xj2ypbilm2xs4bnbid.onion" ], "social": [ "https://www.youtube.com/@TorDaily" ], "doc_hash": "d8fd7eb52af16ceac24fdaad0e9ff7dc8685f22563e4df87fe9d9238f09f4a01", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "de8e8b77056034a96969eba8df35e32f2296c1ef44737c8f37f77fa8447a3900", "1f560c3e9fb5beeed86da7d5be1ae459c22af6ec1d58f77e2a89a20063ef7ba2", "d6c6d0b6440485f2536e96758b074c4713ef69a56511f2af2128f23ce6eebdca", "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3" ], "globals": [ "jQuery", "sf_position", "sf_templates", "sf_input", "tie", "createTicker", "isInTag", "typetext", "tie_isMobile", "html5", "Modernizr", "yepnope", "browserPrefixes", "sf_addItem", "_wpemojiSettings", "$window", "$the_post", "$wrapper", "php_js", "window_height", "isActive", "twemoji", "wp" ], "cookies": [ "wssplashchk" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "tordaily.com", "*.tordaily.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "tordaily.com", "protocol": "QUIC", "valid_to": "2026-11-29T13:04:56Z", "valid_from": "2026-08-31T12:05:06Z" }, "domain_age_days": 2033, "apex_age_days": 2033, "tls_age_days": 0, "tls_valid_days": 90, "requests": 24, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 66, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=0" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:36:33Z", "uuid": "fa19c369-d041-410b-945d-24e9a82dc97e", "scanned_at": "2026-08-31T15:53:08Z", "final_url": "https://tordaily.com/", "status": 200, "history": [ { "url": "https://tordaily.com/", "status": 200 } ], "dom_hash": "40af685a21561973069a31647c27a6f19581d2ef2f40098be02546c36ec9c322", "doc_hash": "fd32a83c963e3cc04421411a93081356bea86ed272eee751e4e680fa248ae176", "domain_risks": [ "News & Media", "Entertainment" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "tordaily.com", "type": "A", "value": "172.67.172.238" }, { "name": "tordaily.com", "type": "A", "value": "104.21.30.129" }, { "name": "tordaily.com", "type": "AAAA", "value": "2606:4700:3031::ac43:acee" }, { "name": "tordaily.com", "type": "AAAA", "value": "2606:4700:3036::6815:1e81" } ], "dnssec_valid": false, "ip": "172.67.172.238", "whois": { "registrar": "DNS Africa Ltd", "created": "2025-05-11T14:51:37Z", "updated": "2026-03-02T18:25:55Z", "expires": "2030-05-11T14:51:37Z", "nameservers": [ "conrad.ns.cloudflare.com", "meadow.ns.cloudflare.com" ] } } } ```