onioninfo[.]com

The domain onioninfo.com has been identified as a generic phishing threat designed to impersonate legitimate Tor network information portals. Analysis indicates this domain was actively targeting users seeking anonymity tools or dark web resources, likely through credential harvesting or malware distribution. Current status is offline, though prior activity warrants monitoring. Infrastructure analysis reveals the domain was registered through Gabia, Inc. and resolved to the IP address 158.247.253.35. Security vendor assessments show 3 of 95 detection engines on VirusTotal flagged this domain as malicious. The domain appears on at least one security blocklist and was previously blocked by enterprise phishing protection systems. The page title displayed as 'onioninfo.com,' suggesting minimal effort to mimic authentic branding, which may indicate opportunistic rather than targeted phishing operations. Risk assessment categorizes this as an elevated threat due to its association with Tor-related impersonation and confirmed malicious detections. While currently offline, historical DNS records and IP associations should be reviewed for potential lateral movement in attacker infrastructure. Organizations are advised to block the domain and IP at perimeter security controls, including firewalls and email gateways. Users who accessed this domain should reset credentials for any services accessed during the exposure window, particularly those related to anonymity tools or cryptocurrency platforms. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range.