torzonmarkets[.]net

PhishDestroy identifies torzonmarkets.net as a live crypto-drainer phishing domain masquerading as a cryptocurrency exchange. The malicious site uses a crypto-drainer kit to steal digital assets from unaware users during transaction signing. No specific brand is being impersonated in this campaign, but the drainer kit follows standard patterns seen in recent theft operations targeting DeFi users. This domain was flagged under seed 68ed10 during automated surveillance of newly registered crypto-services domains. Technical indicators for torzonmarkets.net confirm its malicious intent despite low detection rates. The domain resolves to IP 188.114.97.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It holds a Google Trust Services SSL certificate, indicating potential short-term legitimacy to bypass security filters. As of the latest check, VirusTotal reports 0 detections out of 95 scanners, and the domain remains unlisted on major blocklists including Google Safe Browsing. This domain was created on October 13, 2025, a timestamp that aligns with recent trends in opportunistic phishing campaigns targeting early adopters of new crypto platforms. The threat status remains active and under investigation, with PhishDestroy actively tracking its infrastructure and campaign distribution. Users are advised to block traffic to this domain at the network level and avoid any interaction. The current risk is classified as high due to the live drainer kit and zero detections, indicating that traditional security tools may not yet recognize the threat. PhishDestroy continues to monitor this domain for changes in infrastructure or campaign targeting, and security teams should update threat intelligence feeds accordingly.