tornews[.]com

Analysis of tornews.com indicates a credential phishing operation active as of July 12, 2026. The domain was registered on May 20, 2026, through NameCheap, Inc., and remains operational with a 200 HTTP status. Infrastructure analysis reveals it resolves to 104.21.2.140, hosted behind Cloudflare nameservers (mina.ns.cloudflare.com, simon.ns.cloudflare.com), with an SSL certificate issued by Google Trust Services (WE1). The site is flagged on one security blocklist and detected by 3 of 91 vendors in a recent scan. The page title, 'Deep Web, Cyber Threat Intel, and Privacy Education - TorNews,' suggests an attempt to lure individuals interested in privacy tools, dark web monitoring, or cybersecurity education. Detected technologies include WordPress, Proton Mail, MySQL, PHP, and Cloudflare services, which may be leveraged to enhance legitimacy or facilitate credential harvesting. The domain's classification as 'credential phishing' aligns with its apparent targeting of users seeking sensitive or restricted information. Defenders should treat this domain as high-risk due to its active status, confirmed phishing classification, and use of privacy-focused branding. Blocking or monitoring access to 104.21.2.140 and associated hostnames is recommended. Further investigation into Proton Mail integration and WordPress plugins may reveal additional indicators of compromise or infrastructure reuse. No confirmed brand impersonation was identified in the available data, though the site's theme aligns with privacy and threat intelligence topics.