torzon-market[.]icu

This domain is flagged as a credential harvesting phishing site targeting users through deceptive login and payment portals. Analysis indicates an elevated risk level due to its infrastructure and detection by multiple security mechanisms. The domain is designed to mimic legitimate marketplaces, tricking users into disclosing sensitive credentials or financial information. Infrastructure analysis reveals the following technical indicators: the domain torzon-market.icu was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 45.147.197.100 and employs DDoS-Guard for protection, alongside PHP-based backend technologies. The SSL certificate is issued by Let's Encrypt, a common tactic to appear legitimate. The domain is detected by 7 out of 95 security vendors on VirusTotal and holds a Gridinsoft trust score of 0/100. It appears on one security blocklist and was previously blocked by PhishDestroy. Mitigation steps for this specific threat include immediately ceasing all interaction with the domain and avoiding any input of credentials or personal data. Users who may have engaged with the site should reset passwords for any accounts accessed during the exposure window, particularly those tied to financial or sensitive services. Network administrators are advised to block the domain and its associated IP (45.147.197.100) at the firewall or DNS level. Monitoring for unusual login attempts or unauthorized transactions is critical, as compromised credentials may be exploited in follow-up attacks. Organizations should also review logs for connections to the domain or IP to assess potential exposure within their networks.