torzon-market[.]wiki

This domain, torzon-market[.]wiki, is flagged as a high-risk phishing site impersonating a darknet marketplace. Analysis indicates it mimics legitimate Torzon Market access portals, likely targeting users seeking unauthorized or illicit services. The site presents itself as an "Official Security Guide & Access Links" for Torzon Market 2026, a common tactic to lure victims into credential theft, malware distribution, or financial fraud. No specific drainer kit signatures have been identified, but the domain exhibits characteristics consistent with phishing infrastructure used to harvest login credentials or distribute malicious payloads. Technical indicators confirm the domain's malicious nature. It was registered on May 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive domains. The domain resolves to IP address 172.67.221.224, hosted on Cloudflare infrastructure in Canada, which is often leveraged to obfuscate the true origin of phishing sites. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The site uses a Let's Encrypt SSL certificate (serial number E8), providing a false sense of security to visitors. Google Safe Browsing (GSB) status is not explicitly provided, but the domain's active blocking by at least one security vendor further corroborates its malicious classification. As of the latest assessment, torzon-market[.]wiki remains active and poses an ongoing threat. Users attempting to access darknet marketplaces are advised to avoid this domain entirely, as it may lead to credential compromise, financial loss, or system infection. Network defenders should implement DNS-based blocking for the domain and its associated IP address (172.67.221.224) to prevent access. Given the domain's recent registration and low detection rate, continuous monitoring is recommended, as additional security vendors may flag it in the near future. The use of Cloudflare hosting suggests potential evasion techniques, warranting heightened scrutiny of related domains or IPs within the same infrastructure.