trzm[.]cx

PhishDestroy identifies trzm.cx as an active credential-harvesting domain masquerading as an official TorZon Market mirror to deceive users into surrendering account credentials. The specific threat type is generic phishing with intent to steal login details for darknet-market accounts. trzm.cx was registered on August 28 2024 through CentralNic Ltd and resolves to IP address 188.114.96.3. At the time of assessment the domain carries a Google Trust Services SSL certificate and has not yet been flagged by any of the 95 VirusTotal engines, indicating a window of opportunity for attackers. The page title explicitly claims to list official links and mirrors, directly exploiting trust in the legitimate TorZon brand to lure victims. Users should immediately cease all interaction with trzm.cx, avoid entering any credentials, and clear browser cookies related to TorZon or similar markets. Block the IP 188.114.96.3 at the network perimeter and report the domain to your DNS provider and threat-intel platforms. If you suspect exposure, rotate passwords on a clean device and enable multi-factor authentication on all related accounts. Monitor financial and market accounts for unauthorized transactions and consider freezing linked payment methods until risk is mitigated.