tor-mart[.]pro

Analysis of tor-mart.pro indicates a high‑confidence phishing infrastructure despite the domain being taken offline at the time of reporting on July 24, 2026. The domain was registered through NiceNIC International Group Co., Limited on November 28, 2025 and resolves to the IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) in the United States. Two Cloudflare name servers, logan.ns.cloudflare.com and elisabeth.ns.cloudflare.com, serve the zone, suggesting the attacker leveraged a reputable CDN to hide the true origin of the payload. No TLS certificate is present, meaning the site was reachable only over HTTP, a common characteristic of low‑cost phishing kits that avoid the expense of obtaining certificates.

The page title returned “TOP”, providing no additional context about the intended victim or lure. VirusTotal scans flagged the domain on five of ninety‑five vendor engines, and the domain appears on one external blocklist, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed as blocked by the PhishDestroy service, confirming its identification as a phishing vector. The combination of a recent registration date, Cloudflare‑based hosting, lack of encryption, low trust score, and multiple vendor detections aligns with typical generic phishing campaigns that aim to harvest credentials or deliver malicious redirects.

Uncertainty remains regarding the specific phishing template or the targeted brand, as no brand name or kit identifier is disclosed in the available metadata. Defenders should continue to block the domain at perimeter filters, monitor for any residual DNS queries or HTTP requests, and consider adding the IP address 188.114.96.3 to reputation‑based deny lists.