torzon[.]camp

Analysis of torzon.camp, observed on July 25, 2026, indicates a high‑risk generic phishing operation that remains active. The site returns HTTP 200 and presents the page title “DARKNET PULSE | Marketplace Status Monitor,” a title unrelated to any legitimate service, suggesting content manipulation. The domain is hosted behind Cloudflare, resolving to IP 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is located in the United States. Nameserver records point to sarah.ns.cloudflare.com and javon.ns.cloudflare.com, confirming Cloudflare’s DNS infrastructure. The SSL certificate is issued by Google Trust Services under the WE1 label, providing a valid HTTPS connection that may lend false credibility to the page.

Registration data shows the domain was created on February 23, 2026 via NiceNIC International Group Co., Limited, a registrar known to host a range of malicious sites. The domain appears on one security blocklist and has been flagged by PhishDestroy, indicating that at least one anti‑phishing service has taken action. VirusTotal scans report a single positive detection out of 93 security vendors, reinforcing the suspicion of malicious intent. Additionally, Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, underscoring the site’s poor reputation.

Technologically, the site employs PHP, Tailwind CSS, jsDelivr, and Cloudflare Browser Insights, and supports HTTP/3, all typical of modern web stacks but not indicative of benign purpose. The combination of a generic phishing classification, active status, low trust metrics, and the presence on a blocklist suggests that the domain is being used to harvest credentials or lure victims under the guise of a darknet‑related service.

Defenders should immediately block torzon.camp at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for outbound connections to the associated Cloudflare IP.