torzon-market-access[.]shop

This domain, torzon-market-access.shop, is flagged as an active phishing site impersonating Torzon Market, a darknet marketplace. Registered on April 4, 2026, through Nicenic International Group Co., Limited, the domain resolves to 188.114.96.3, a Cloudflare IP address located in Canada. Infrastructure analysis reveals Cloudflare nameservers (clay.ns.cloudflare.com and kami.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), which are common among both legitimate and malicious sites. The page title, 'Torzon Market Access | Official Links & Verified Mirrors,' explicitly suggests an attempt to deceive users into believing the site provides legitimate access to Torzon Market, aligning with the 'Fake Exchange' scam type noted in available intelligence. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating the phishing page is operational. It has been blocked by at least one security vendor (PhishDestroy) and appears on one security blocklist. AlienVault OTX includes the domain in a threat intelligence pulse, further corroborating its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment. While VirusTotal shows only one detection out of 94 vendors, this does not diminish the domain's confirmed malicious status, as detection rates can vary based on vendor signatures and scanning timing. Defenders should treat this domain as a confirmed phishing threat targeting users seeking access to Torzon Market. Recommended actions include immediate blocking at the DNS or network level, monitoring for related infrastructure (e.g., associated IPs or nameservers), and alerting users to the risks of interacting with unverified marketplace access portals. The exact content and functionality of the site remain unanalyzed, but the available indicators strongly suggest it is designed to harvest credentials or distribute malicious payloads.