torzon-mirrors[.]cfd

This domain, torzon-mirrors.cfd, is flagged as a credential theft operation impersonating the Torzon darknet marketplace. Analysis indicates the site replicates legitimate Tor Market login portals to harvest user credentials, including wallet access codes and two-factor authentication tokens. No direct evidence of a crypto drainer kit was observed, but the credential harvesting infrastructure aligns with known darknet marketplace phishing campaigns targeting both vendors and buyers. Infrastructure analysis reveals the domain was registered on June 8, 2026, through Dynadot Inc, resolving to IP address 45.147.197.100. The SSL certificate is issued by Let's Encrypt, a common choice for malicious domains due to its low validation requirements. Detection metrics show 5 out of 95 security vendors on VirusTotal flagged the domain, while it appears on 2 security blocklists and is referenced in 4 AlienVault OTX threat intelligence pulses. The domain holds a Gridinsoft trust score of 0/100, further confirming its malicious classification. Google Safe Browsing status is not explicitly listed, but the domain is actively blocked by PhishDestroy and OISD. As of the latest assessment, torzon-mirrors.cfd has been taken offline, likely due to registrar or hosting provider intervention. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered mirrors. Users who interacted with the site are advised to rotate all credentials, particularly those tied to darknet marketplaces, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP address to prevent future access attempts.