torzonportal[.]xyz

This domain, torzonportal.xyz, is identified as a phishing site specifically targeting users attempting to access Torzon Market, a known darknet marketplace. The threat type is classified as generic_phishing with an elevated risk level, focusing on distributing fraudulent onion links under the guise of verified access. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used to deceive users seeking darknet services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 45.93.8.168, which is associated with hosting services running Ubuntu and Nginx. Security vendor assessments show the domain was flagged by 5 of 95 vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. Additionally, the domain appears on one security blocklist and was blocked by PhishDestroy. The page title, "Torzon Market 2026 - Official Onion Links & Verified Access," further confirms its intent to impersonate legitimate Torzon Market resources. As of the latest assessment, torzonportal.xyz is offline, reducing immediate exposure risk. However, organizations and users should remain vigilant, as similar domains may re-emerge. Recommended actions include blocking the domain and its associated IP (45.93.8.168) at the network level, updating endpoint protection rules to detect phishing attempts referencing Torzon Market, and monitoring for newly registered domains with similar naming patterns. Users who accessed the domain should assume credentials or other sensitive data may have been compromised and take appropriate remediation steps, such as password resets and system scans.